From 644a40674d51f42171d2f20af58616c712763acc Mon Sep 17 00:00:00 2001
From: Robert Resch <robert@resch.dev>
Date: Fri, 16 Jan 2026 09:21:19 +0100
Subject: [PATCH] Make shebang matcher stricter (#160986)

---
 .github/workflows/ci.yaml                                 | 8 +-------
 .../matchers/check-executables-have-shebangs.json         | 2 +-
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index ded82ae564f..ba68414b30a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -247,17 +247,11 @@ jobs:
       && github.event.inputs.audit-licenses-only != 'true'
     steps:
       - *checkout
-      - name: Register yamllint problem matcher
+      - name: Register problem matchers
         run: |
           echo "::add-matcher::.github/workflows/matchers/yamllint.json"
-      - name: Register check-json problem matcher
-        run: |
           echo "::add-matcher::.github/workflows/matchers/check-json.json"
-      - name: Register check executables problem matcher
-        run: |
           echo "::add-matcher::.github/workflows/matchers/check-executables-have-shebangs.json"
-      - name: Register codespell problem matcher
-        run: |
           echo "::add-matcher::.github/workflows/matchers/codespell.json"
       - name: Run prek
         uses: j178/prek-action@9d6a3097e0c1865ecce00cfb89fe80f2ee91b547 # v1.0.12
diff --git a/.github/workflows/matchers/check-executables-have-shebangs.json b/.github/workflows/matchers/check-executables-have-shebangs.json
index 667ef795632..1ff6ae0e94c 100644
--- a/.github/workflows/matchers/check-executables-have-shebangs.json
+++ b/.github/workflows/matchers/check-executables-have-shebangs.json
@@ -4,7 +4,7 @@
       "owner": "check-executables-have-shebangs",
       "pattern": [
         {
-          "regexp": "^(.+):\\s(.+)$",
+          "regexp": "^(.+):\\s(marked executable but has no \\(or invalid\\) shebang!.*)$",
           "file": 1,
           "message": 2
         }