Fix ShellCheck CI false positives and harden ShellCheck workflow permissions

[Copilot]

The shellcheck GitHub Actions job failed on the main script due to static-analysis false positives around sourcing /etc/os-release. This change makes that sourcing explicit for linting and ensures referenced OS metadata variables are always defined in-script.

• Lint-scope fix for external source

  • Added a targeted ShellCheck suppression directly on the /etc/os-release source line to handle CI lint context where the file is not part of analyzed inputs.
  • Kept an explicit ShellCheck source hint alongside the suppression during conflict resolution.

• Defensive initialization of sourced vars

  • Initialized NAME and VERSION with default-empty fallbacks immediately after sourcing, removing SC2153 undefined-variable findings without changing runtime behavior.

• Workflow security hardening

  • Added explicit minimal token permissions to the ShellCheck workflow:
    • permissions:
    • contents: read
  • This resolves the CodeQL Actions alert for missing workflow permissions.

• Touched files

  • opensuse-migration-tool
  • .github/workflows/shellcheck.yml

# shellcheck disable=SC1091
# shellcheck source=/etc/os-release
source /etc/os-release
NAME=${NAME:-}
VERSION=${VERSION:-}

[lkocman]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved and pushed. The merge conflicts were fixed in commit 43c1b23, and I also pushed a small follow-up CI security fix in 1350cf2.

[Copilot]

Pull request overview

This PR addresses ShellCheck CI false positives around sourcing /etc/os-release and variables populated from it, while tightening workflow permissions.

Changes:

• Suppresses ShellCheck’s external source warning for /etc/os-release.
• Initializes NAME and VERSION after sourcing to satisfy static analysis.
• Adds read-only repository contents permission to the ShellCheck workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
opensuse-migration-tool	Updates ShellCheck handling for /etc/os-release-provided variables.
.github/workflows/shellcheck.yml	Adds minimal contents: read permission for the workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.