env key is ignored by shellcheck

[ReenigneArcher]

Given the following snip (from LizardByte/.github#533, though I will likely have already worked around this error):

      - name: Test
        env:
          BRANCH: ${{ github.ref }}
          COMMIT: ${{ inputs.release_commit }}
        shell: bash
        run: |
          # get variables
          branch="${BRANCH}"
          commit="${COMMIT}"

I get the following output:

Error: .github/workflows/__call-docker.yml:154:9: shellcheck reported issue in this script: SC2153:info:2:9: Possible misspelling: BRANCH may not be assigned. Did you mean branch? [shellcheck]
    |
154 |         run: |
    |         ^~~~
Error: .github/workflows/__call-docker.yml:154:9: shellcheck reported issue in this script: SC2153:info:3:9: Possible misspelling: COMMIT may not be assigned. Did you mean commit? [shellcheck]
    |
154 |         run: |
    |         ^~~~
Error: Process completed with exit code 1.

I am moving the variables to the env block to prevent shell injection attacks as attackers can easily mess with CI if they are creative with their branch names.

Interestingly, I used the exact same pattern in this PR which did not have any errors with actionlint: https://github.com/LizardByte/Sunshine/pull/4266/files

[rhysd]

shellcheck doesn't seem to have configuration to list available environment variables. However it looks at the existing environment variables.

Currently actionlint simply runs subprocesses inheriting its environment variables. So the environment variables which are not defined when actionlint is run are not recognized by shellcheck. However actionlint should know the list of environment variables so it can spawn shellcheck subprocess defining dummy variables to tell what environment variables are defined.

I think this requires sharing the information about environment variables between rules and it needs architecture consideration. Meanwhile please consider to ignore the false-positives by configuration.

https://github.com/rhysd/actionlint/blob/main/docs/config.md