From eb619243dc37ff0ecec5ae259bb736a8b686f26e Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Wed, 19 Aug 2026 00:38:15 -0700
Subject: [PATCH 1/2] ci: also run the tests against the latest shfmt

The formatter tests assert on shfmt's output and on its error messages,
both of which change from time to time. The shfmt in the Ubuntu archive
lags well behind, so those changes are only noticed once a user on a
more current distribution reports the failure.

Add one job that runs against the latest shfmt release. It is an extra
matrix entry rather than a second axis, so this costs a single job
rather than doubling the matrix.

The archive shfmt is now installed only in the jobs that ask for it, so
that the two never end up on PATH together.
---
 .github/workflows/verify.yml | 36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index a727a5e2..241170ca 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -7,15 +7,45 @@ jobs:
 
     runs-on: ubuntu-latest
 
+    name: verify (node ${{ matrix.node-version }}, ${{ matrix.shfmt }} shfmt)
+
     strategy:
+      fail-fast: false
       matrix:
         node-version: [20.x, 22.x]
+        shfmt: [distro]
+        include:
+          # shfmt occasionally changes its output and its error messages, which
+          # the formatter tests assert on. The archive version lags well behind,
+          # so run one job against the latest release to catch such changes when
+          # they happen rather than when a user reports them.
+          - node-version: 22.x
+            shfmt: latest
 
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install shellcheck and shfmt (used for testing)
-        run: sudo apt-get install -y shellcheck shfmt
+      - name: Install shellcheck (used for testing)
+        run: sudo apt-get install -y shellcheck
+
+      - name: Install shfmt from the Ubuntu archive (used for testing)
+        if: matrix.shfmt == 'distro'
+        run: sudo apt-get install -y shfmt
+
+      - name: Install the latest shfmt release (used for testing)
+        if: matrix.shfmt == 'latest'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag=$(gh release view --repo mvdan/sh --json tagName --jq .tagName)
+          sudo curl -fsSL -o /usr/local/bin/shfmt \
+            "https://github.com/mvdan/sh/releases/download/$tag/shfmt_${tag}_linux_amd64"
+          sudo chmod +x /usr/local/bin/shfmt
+
+      - name: Show which shfmt is used
+        run: |
+          command -v shfmt
+          shfmt --version
 
       - uses: pnpm/action-setup@v4
         with:
@@ -34,7 +64,7 @@ jobs:
 
       - name: Publish coverage to codecov.io
         uses: codecov/codecov-action@v5
-        if: success() && matrix.node-version == '22.x'
+        if: success() && matrix.node-version == '22.x' && matrix.shfmt == 'distro'
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./codecov.yml

From a3ed74f50814de869fdf9a236dcf321cfbf707dd Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Wed, 19 Aug 2026 01:46:54 -0700
Subject: [PATCH 2/2] ci: add all-done job

The sole purpose is to make branch protection rules simple: instead of
requiring jobs which names can change (like in the previous commit), add
a summarizing job, which is the only one that should be required.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 .github/workflows/verify.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 241170ca..cedb5024 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -68,3 +68,10 @@ jobs:
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./codecov.yml
+
+  all-done:
+    needs:
+      - verify
+    runs-on: ubuntu-latest
+    steps:
+    - run: echo "All jobs completed"