Added link to shellcheck-scan the GitHub Action 🤝

[reactive-firewall]

Update README.md

Added link to ShellCheck SARIF Analysis GitHub Action - A third-party OSS action that generates SARIF reports from ShellCheck analysis, enabling GitHub Advanced Security integration. Helps teams track shell script quality through GitHub's code scanning UI without additional configuration.

Additional details:

Marketplace link: ShellCheck SARIF Analysis
Release Notes: Latest Release Notes
Public Repository: shellcheck-scan

---

Contributor hereby acknowledges:

• Contributions must be licensed under the GNU GPLv3.
  • The contributor retains the copyright.

[reactive-firewall]

🙇 sorry I'm late to the topic

Additional relevant discussions found in:

• resolves/contributes to Provide SARIF Output ? #2405

  • Those interested in a SOLID workaround for Provide SARIF Output ? #2405 may be interested in the MIT licensed tool used by ShellCheck SARIF Analysis that converts the output from shellcheck into valid SARIF directly. 🙊 Note however due to cc-left type licensing conflicts the tool will not be converted to Haskel for contributing to spellcheck anytime in the foreseeable future. 🤷 The project, does includes a re-released (explicitly stripped down) variant for the GPLv3 action written in python.

• SUPERSEDES and resolves unmerged PR/MR Support for SARIF output format #2569 - also enhances with proper SARIF (including rules and documentation built dynamically from shellcheck's output)

  • No need for additional support by @koalaman as the GHA action leaves shellcheck's code untouched.

• see also Should this project contain/support a GitHub Action for shellcheck? #1492
• see also Add a github action with check-runs #1943

[reactive-firewall]

GHA Works on non-linux now 🎁

TL;DR

🤷🏻 So I went ahead and just added support for including the `ShellCheck SARIF Analysis` github action on any OS-latest runner. This both automates setup-of shellcheck and invoking and generating the SARIF report, however this means if users with they can include the action to automate the setup on non-linux runners and not give permissions to upload the SARIF report by limiting permissions (e.g. _not_ granting `security-event: write`) your milage may very.