GitHub Actions curl rules parse explicit PowerShell steps as Bash

[meza]

Affected rules

• yaml.github-actions.security.curl-eval.curl-eval (YDTZe7K)
• yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell (9lT3zYb)

Semgrep version

1.169.0

Minimal reproduction

jobs:
  test:
    runs-on: windows-latest
    steps:
      - shell: pwsh
        run: |
          $cacheDirs = @("D:\cache")
          foreach ($dir in $cacheDirs) {
            New-Item -ItemType Directory -Path $dir -Force | Out-Null
          }

semgrep scan --config p/default --strict workflow.yml

Actual behavior

Both rules pass every run: scalar to a Bash metavariable-pattern, even when the step explicitly declares shell: pwsh. Semgrep emits PartialParsing errors and exits 3. With multiple PowerShell steps, each rule emits an error for each step and those lines are skipped.

Expected behavior

Rules whose nested parser is Bash should restrict analysis to Bash/default-shell steps, or use a text-based predicate that can safely inspect all shell bodies without producing parser errors.