Linting for shell and GitHub Actions

.github/workflows/build_docs.yml

@@ -29,6 +29,8 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout code
+        with:
+          persist-credentials: false
         uses: actions/checkout@v4
 
       - name: Install Python

.github/workflows/fypp_checks.yml

@@ -23,6 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v4
       with:
         python-version: "3.11"

.github/workflows/static_analysis.yml

@@ -10,14 +10,16 @@ on:
   # Triggers the workflow on pushes to open pull requests with code changes
   pull_request:
     paths:
-      - '.github/workflows/static_analysis.yml'
+      - '.github/workflows/*.yml'
       - '**.c'
       - '**.cpp'
       - '**.fypp'
       - '**.f90'
       - '**.F90'
       - '**.pf'
       - '**.py'
+      - '**.sh'
+      - '**CMakeLists.txt'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
@@ -35,6 +37,8 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout code
+        with:
+          persist-credentials: false
         uses: actions/checkout@v4
 
       - name: Install Python
@@ -63,13 +67,31 @@ jobs:
           cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${BUILD_DIR} -DCMAKE_Fortran_FLAGS="-std=f2008" -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
 
       # Apply CMake linter, cmake-lint
-      - name: cmake
+      - name: cmake-lint
         if: always()
         run: |
           cd ${{ github.workspace }}
           . ftorch_venv/bin/activate
           cmake-lint $(find . -name CMakeLists.txt)
 
+      # Apply Shell linter, shellcheck
+      - name: shellcheck
+        if: always()
+        run: |
+          cd ${{ github.workspace }}
+          sudo apt install shellcheck
+          for FILE in $(find . -name "*.sh"); do
+            shellcheck ${FILE}
+          done
+
+      # Apply GitHub Actions linter, zizmor
+      - name: zizmor
+        if: always()
+        run: |
+          cd ${{ github.workspace }}
+          . ftorch_venv/bin/activate
+          zizmor .github/workflows/*.yml
+
       # Apply Fortran linter, fortitude
       # Configurable using the fortitude.toml file if present
       - name: fortitude source

.github/workflows/test_suite_ubuntu.yml

@@ -46,6 +46,8 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout code
+        with:
+          persist-credentials: false
         uses: actions/checkout@v4
 
       - name: Install Python

.github/workflows/test_suite_windows.yml

@@ -11,14 +11,14 @@ on:
   pull_request:
     paths:
       - '.github/workflows/test_suite_windows.yml'
+      - '**.bat'
       - '**.c'
       - '**.cpp'
       - '**.fypp'
       - '**.f90'
       - '**.F90'
       - '**.pf'
       - '**.py'
-      - '**.sh'
       - '**CMakeLists.txt'
       - '**requirements.txt'
       - '**data/*'
@@ -53,6 +53,8 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout code
+        with:
+          persist-credentials: false
         uses: actions/checkout@v4
 
       - name: Install Python
@@ -69,11 +71,13 @@ jobs:
         shell: cmd
         run: |
           cd src
+          rem find torch location
+          for /f "tokens=2*" %%i in ('pip show torch ^| findstr /R "^Location"') do set torch_path=%%i
           cmake ^
             -Bbuild ^
             -G "NMake Makefiles" ^
             -DCMAKE_Fortran_FLAGS="/fpscomp:logicals" ^
-            -DCMAKE_PREFIX_PATH="C:\hostedtoolcache\windows\Python\3.12.7\x64\Lib\site-packages" ^
+            -DCMAKE_PREFIX_PATH=%torch_path% ^
             -DCMAKE_BUILD_TYPE=Release ^
             -DCMAKE_Fortran_COMPILER=ifx ^
             -DCMAKE_C_COMPILER=icx ^
@@ -85,7 +89,7 @@ jobs:
       - name: Integration tests
         shell: cmd
         run: |
-          set PATH=C:\hostedtoolcache\windows\Python\3.12.7\x64\Lib\site-packages;%PATH%
+          for /f "tokens=2*" %%i in ('pip show torch ^| findstr /R "^Location"') do set torch_path=%%i
           set PATH=C:\Program Files (x86)\FTorch\bin;%PATH%
-          set PATH=C:\hostedtoolcache\windows\Python\3.12.7\x64\Lib\site-packages\torch\lib;%PATH%
+          set PATH=%torch_path%\torch\lib;%PATH%
           run_integration_tests.bat

requirements.txt

@@ -3,3 +3,4 @@ fortitude-lint==0.6.0
 clang-format==19.1.3
 clang-tidy==19.1.0
 cmakelang
+zizmor

run_integration_tests.sh

@@ -11,13 +11,12 @@
 
 set -eu
 
-CTEST_ARGS=$@
 EXAMPLES="1_SimpleNet 2_ResNet18 4_MultiIO 6_Autograd"
 BUILD_DIR=src/build
 
 for EXAMPLE in ${EXAMPLES}; do
-  pip -q install -r examples/${EXAMPLE}/requirements.txt
-  cd ${BUILD_DIR}/test/examples/${EXAMPLE}
-  ctest ${CTEST_ARGS}
+  pip -q install -r examples/"${EXAMPLE}"/requirements.txt
+  cd "${BUILD_DIR}"/test/examples/"${EXAMPLE}"
+  ctest "$@"
   cd -
 done