Silence SC1090 on the workflow steps that source '.env'

[AlexSkrypnyk]

Summary

actionlint reports shellcheck SC1090 on every workflow step that sources .env, because the path is built at runtime and shellcheck cannot follow it. The sourcing is intentional, so the finding is noise - but it is noise on four steps across two workflows, which trains people to ignore actionlint output.

Details

The step appears once in .github/workflows/audit.yml and three times in .github/workflows/build-test-deploy.yml:

- name: Load environment variables from .env
  run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV"

actionlint reports:

shellcheck reported issue in this script: SC1090:warning:1:71:
ShellCheck can't follow non-constant source. Use a directive to specify location

Suggested change

Convert the run value to a block scalar so a directive can precede the command:

- name: Load environment variables from .env
  run: |
    # shellcheck source=/dev/null
    t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV"

Applying it to all four occurrences keeps the two workflows consistent - fixing only the one an automated reviewer happens to flag leaves them divergent.

How this surfaced

Raised by an automated review on a consumer project's 1.41.0 update PR. Applied there to all four steps, and worth carrying upstream so other consumers do not each patch their own copy.

[AlexSkrypnyk]

Not proceeding.

The actionlint invocation in vortex-test-common.yml already passes -ignore 'SC1090:', so this finding does not appear in the repository's own CI. There is nothing to fix here.

Suppressing it for scaffolded projects is a different problem, and it has only three possible solutions:

1. A # shellcheck source=/dev/null directive, which turns each single-line run: scalar into a three-line block scalar.
2. A rewrite of the command so the sourced path is not built at runtime, for example ${HOME}/.env.snapshot in place of mktemp. This clears the rule with no suppression at all, but changes a command that is deliberately identical across the GitHub Actions and CircleCI configurations.
3. A .github/actionlint.yml shipped with the template.

The template ships no actionlint invocation, so there is no command-line flag to carry the ignore, and none of the three options is worth its cost. The finding originated from a third-party review tool rather than from a linter Vortex configures.