ci: answer the shellcheck and actionlint findings

Nine findings across the shell scripts and the `run:` blocks, reducing to three
causes. None had ever been reported by anything the repository runs: shellcheck
and actionlint are not installed here, and SonarQube's shell analysis arrives
after the merge.

SC1091, twice, was real. `. "$(dirname "$0")/../trains.sh"` is a path shellcheck
cannot resolve statically, so it was skipping the sourced file entirely — the
single source of truth for the release trains went unchecked in both scripts
that read it. A `# shellcheck source=` directive fixes the analysis, not just the
message.

The other seven are false positives, each annotated where it fires rather than
disabled repository-wide. SC2016 (five) reads the Markdown backticks in a printf
format as command substitution; every one of these formats emits a step summary
or a pull-request comment. SC2317 (two) calls the hook's two rule functions
unreachable, because they are reached through the `"rule_${rule}"` dispatch a
static reader cannot follow — the rule's own message says to ignore it when the
call is indirect.

A `.shellcheckrc` would have silenced all seven in one line and blinded both
rules everywhere else, including where they are right.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017bxVrnCNsXW3RvwmLc9Kvy

Author: claude

.claude/hooks/coding-rules.sh

@@ -61,6 +61,7 @@ display="${file##*/}"
 # (documentation routinely shows `var` in sample code), an anonymous type (C#
 # gives no other spelling), and an occurrence inside a string literal (the
 # analyzer suites embed C# fixtures that deliberately use `var`).
+# shellcheck disable=SC2317  # reached through the `"rule_${rule}"` dispatch in the run section below
 rule_explicit_types() {
   awk -v name="$display" '
     {
@@ -93,6 +94,7 @@ rule_explicit_types() {
   ' "$file"
 }
 
+# shellcheck disable=SC2317  # reached through the `"${rule}_hint"` dispatch in the run section below
 explicit_types_hint() {
   printf '%s' "Coding rule — explicit types (CLAUDE.md, \"Coding rules\"). This file now declares
 inferred types:

.github/workflows/adr-check.yml

@@ -123,6 +123,7 @@ jobs:
           if [ "$needs" = "true" ] && [ -n "$report" ]; then
             printf '%s\n' "$report" >> "$GITHUB_STEP_SUMMARY"
           else
+            # shellcheck disable=SC2016  # the backticks are Markdown, not command substitution
             printf '### 🏛️ ADR check (advisory)\n\nNo architectural decision detected on `%s` versus `%s`. Nothing to flag.\n' \
               "$BRANCH" "$BASE" >> "$GITHUB_STEP_SUMMARY"
           fi

.github/workflows/dependabot-autofix.yml

@@ -302,13 +302,16 @@ jobs:
               patch="$(jq -r '.patch // ""' verdict.json)"
               msg="$(jq -r '.commit_message // ""' verdict.json)"
               if [ -n "$patch" ]; then
+                # shellcheck disable=SC2016  # the backticks are Markdown, not command substitution
                 printf 'Apply it yourself:\n\n```diff\n%s\n```\n\n' "$patch"
+                # shellcheck disable=SC2016  # the backticks are Markdown, not command substitution
                 [ -n "$msg" ] && printf 'Commit it as:\n\n```\n%s\n```\n\n' "$msg"
               fi
             else
               printf '**🧑 Needs a human** — %s.\n\n' "$category"
               [ -n "$explanation" ] && printf '%s\n\n' "$explanation"
             fi
+            # shellcheck disable=SC2016  # the backticks are Markdown, not command substitution
             printf '_No dependency version was changed. See `%s`._\n' "$doc"
           } > comment-body.md
 

tools/analyzer-count-check/check-analyzer-count.sh

@@ -68,6 +68,7 @@ fi
 
 if [ "$status" -ne 0 ]; then
   printf '\nUpdate the bullet in FirstClassErrors/README.nuget.md to read:\n' >&2
+  # shellcheck disable=SC2016  # the backticks are Markdown code spans in the format string, not command substitution
   printf '  **%s Roslyn analyzers in the box (`%s`-`%s`).**\n' "$count" "$low" "$high" >&2
   exit 1
 fi

tools/changelog/collect-prs.sh

@@ -28,6 +28,7 @@ set -eu
 component="${1:-}"
 # Tag prefix and train scopes come from tools/trains.sh (the single source of truth
 # shared with release-notes.sh), so the changelog and the release notes never diverge.
+# shellcheck source=tools/trains.sh
 . "$(dirname "$0")/../trains.sh"
 prefix="$(prefix_of "$component")"
 train_scopes="$(scopes_of "$component")"

tools/packaging/release-notes.sh

@@ -30,6 +30,7 @@ end_ref="${3:-$current_tag}"
 
 # Tag prefix and train scopes come from tools/trains.sh (the single source of truth
 # shared with the changelog tooling), so the two can never disagree on the partition.
+# shellcheck source=tools/trains.sh
 . "$(dirname "$0")/../trains.sh"
 prefix="$(prefix_of "$scope")"
 train_scopes="$(scopes_of "$scope")"