ci(gh-actions): bash strict mode

Author: thomasleplus

.github/workflows/docker-build-push.yml

@@ -86,8 +86,7 @@ jobs:
         run: |
           set -euo pipefail
           IFS=$'\n\t'
-          # shellcheck disable=SC2086
-          VERSION="$(\grep ${IMAGE}/Dockerfile -e '^FROM' | \head -n 1 | \sed -e 's/@.*$//; s/^.*://;')"
+          VERSION="$(\grep "${IMAGE}/Dockerfile" -e '^FROM' | \head -n 1 | \sed -e 's/@.*$//; s/^.*://;')"
           if [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] ; then
             echo "VERSION=${VERSION}" >> "${GITHUB_ENV}"
           fi

.github/workflows/docker-release.yml

@@ -65,9 +65,8 @@ jobs:
         run: |
           set -euo pipefail
           IFS=$'\n\t'
-          images=""
+          images=()
           for tag in ${TAGS}; do
-            images+="${tag}@${DIGEST} "
+            images+=("${tag}@${DIGEST}")
           done
-          # shellcheck disable=SC2086
-          cosign sign --recursive --yes ${images}
+          cosign sign --recursive --yes "${images[@]}"

.github/workflows/maven-dependency-check.yml

@@ -42,7 +42,7 @@ jobs:
           set -euo pipefail
           IFS=$'\n\t'
           # shellcheck disable=SC2086
-          ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.NVDApiKey=${NVD_API_KEY} dependency-check:aggregate
+          IFS=$' \n\t' ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.NVDApiKey=${NVD_API_KEY} dependency-check:aggregate
       - name: Upload artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with: