set-unconfined-userns on for oniux #26

	---
	name: Run script tests

	'on':
	push:
	paths:
	- "*/.sh"
	- "*/.ksh"
	- "*/.bash"
	- "*/.pl"
	- "Makefile"
	- ".github/workflows/run-tests.yml"
	pull_request:
	paths:
	- "*/.sh"
	- "*/.ksh"
	- "*/.bash"
	- "*/.pl"
	- "Makefile"
	- ".github/workflows/run-tests.yml"
	workflow_dispatch: {}

	permissions:
	contents: read

	jobs:
	test:
	runs-on: ubuntu-latest

	defaults:
	run:
	shell: bash

	steps:
	- name: Checkout
	uses: actions/checkout@v4

	# Go is only used to install checkmake, so disable module caching
	- name: Setup Go (for checkmake)
	uses: actions/setup-go@v5
	with:
	go-version: "stable"
	cache: false

	- name: Setup Python (for mbake)
	uses: actions/setup-python@v5
	with:
	python-version: "3.x"

	- name: Install apt dependencies
	run: \|
	set -euo pipefail
	sudo apt-get update
	sudo apt-get install -y \
	perl \
	perltidy \
	shfmt \
	shellcheck \
	ksh \
	bmake

	- name: Install checkmake and mbake
	run: \|
	set -euo pipefail

	# Persist user bins across steps
	echo "$HOME/.local/bin" >> "$GITHUB_PATH"
	echo "$HOME/go/bin" >> "$GITHUB_PATH"

	# checkmake (Go)
	go install github.com/mrtazz/checkmake/cmd/checkmake@latest
	checkmake --version

	# mbake (Python)
	python -m pip install --upgrade pip
	python -m pip install --user mbake
	mbake --version

	- name: Run tests
	run: \|
	set -euo pipefail
	make test

	- name: Print validate logs
	if: always()
	run: \|
	echo "Listing /tmp/validate-*.log"
	shopt -s nullglob
	for f in /tmp/validate-*.log; do
	echo "=== $f ==="
	sed -n '1,400p' "$f"
	done

Provide feedback