ci(gh-actions): bash strict mode

Author: thomasleplus

.github/workflows/docker-build-push.yml

@@ -86,8 +86,7 @@ jobs:
         run: |
           set -euo pipefail
           IFS=$'\n\t'
-          # shellcheck disable=SC2086
-          VERSION="$(\grep ${IMAGE}/Dockerfile -e '^FROM' | \head -n 1 | \sed -e 's/@.*$//; s/^.*://;')"
+          VERSION="$(\grep "${IMAGE}/Dockerfile" -e '^FROM' | \head -n 1 | \sed -e 's/@.*$//; s/^.*://;')"
           if [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] ; then
             echo "VERSION=${VERSION}" >> "${GITHUB_ENV}"
           fi

.github/workflows/docker-release.yml

@@ -65,9 +65,8 @@ jobs:
         run: |
           set -euo pipefail
           IFS=$'\n\t'
-          images=""
+          images=()
           for tag in ${TAGS}; do
-            images+="${tag}@${DIGEST} "
+            images+=("${tag}@${DIGEST}")
           done
-          # shellcheck disable=SC2086
-          cosign sign --recursive --yes ${images}
+          cosign sign --recursive --yes "${images[@]}"