Run the checks under bash, not sh

First run on the ifc runner failed both jobs at exit 127 with
"shopt: not found". The runner executes a `run:` block with /bin/sh
(dash) unless the step says otherwise, where GitHub defaults to bash --
so `shopt -s globstar` died before either script reached a file.

Setting `shell: bash` explicitly is the fix. The `[[ ]]` tests and the
array handling in ids-lint need it too, so this is load-bearing rather
than tidiness.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T93BEAfP4jvcYo7oMo5AL1

.forgejo/workflows/ids-lint.yml

@@ -1,3 +1,16 @@
+# IDS compliance: every rule in every IDS/**/*.ids, against every model.
+#
+# Port of .github/workflows/ids-lint.yml. The script body is unchanged apart
+# from skipping libraries/; only the setup steps and `runs-on:` differ, because
+# ifc-ci already contains ifctester and idssplit.
+#
+# idssplit splits each IDS file into one file per rule before testing, so a
+# failure names the specific rule rather than only the specification.
+#
+# Runs on the user-scoped `ifc` runner (user ci-ifc) on hub.postle.net, whose
+# root-owned config.yaml has an empty `valid_volumes` -- no host path can be
+# mounted, which is what makes it safe for an outside contributor's PR.
+
 name: IDS Compliance Check
 
 on:
@@ -7,23 +20,25 @@ on:
 
 jobs:
   ids-lint:
-    runs-on: ubuntu-latest
+    runs-on: ifc
+    container:
+      image: hub.postle.net/bruno/ifc-ci:latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-
-      - name: Install ifctester and idssplit
-        run: |
-          pip install ifctester
-          pip install --no-deps https://github.com/brunopostle/idssplit/releases/download/0.1.0/idssplit-0.1.0-py3-none-any.whl
+        uses: actions/checkout@v4
 
       - name: Run IDS validations
+        # shell: bash is REQUIRED, not decoration. The runner executes `run:`
+        # blocks with /bin/sh (dash) unless told otherwise, so the GitHub
+        # original's `shopt -s globstar` dies with "shopt: not found" and
+        # exit 127 before the first file is checked. `[[ ]]` and arrays need
+        # bash too.
+        shell: bash
+        # Deliberately greps output instead of trusting the exit status:
+        # ifctester's CLI has no sys.exit anywhere, so a model that violates
+        # every rule still exits 0. A naive `run: ifctester ...` would be a
+        # permanently green check that can never fail.
         run: |
           set -e
           shopt -s globstar nullglob
@@ -40,7 +55,12 @@ jobs:
             exit 0
           fi
 
-          ifc_files=(**/*.ifc)
+          # libraries/ holds vendored component sources, not deliverable models.
+          ifc_files=()
+          for f in **/*.ifc; do
+            [[ "$f" == libraries/* ]] && continue
+            ifc_files+=("$f")
+          done
 
           if [ ${#ifc_files[@]} -eq 0 ]; then
             echo "No IFC files found"

.forgejo/workflows/ifc-lint.yml

@@ -0,0 +1,45 @@
+# Schema/rule validation for every IFC model in the repo.
+#
+# Port of .github/workflows/ifc-lint.yml. Only the setup steps and `runs-on:`
+# changed: `ifc-ci` already contains ifcopenshell, so there is no setup-python
+# and no pip install -- on GitHub those were most of the runtime.
+#
+# Runs on the user-scoped `ifc` runner (user ci-ifc) on hub.postle.net, whose
+# root-owned config.yaml has an empty `valid_volumes`. A job here can mount no
+# host path at all, which is what makes it safe to run an outside contributor's
+# pull request.
+
+name: IFC Validation
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  lint-ifc:
+    runs-on: ifc
+    container:
+      image: hub.postle.net/bruno/ifc-ci:latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run IFC lint checks
+        # shell: bash is REQUIRED, not decoration. The runner executes `run:`
+        # blocks with /bin/sh (dash) unless told otherwise, so the GitHub
+        # original's `shopt -s globstar` dies with "shopt: not found" and
+        # exit 127 before the first file is checked. `[[ ]]` and arrays need
+        # bash too.
+        shell: bash
+        # Gates on its own exit status: ifcopenshell.validate calls sys.exit()
+        # on failure, so `set -e` fails the job.
+        run: |
+          set -e
+          shopt -s globstar nullglob
+          for file in **/*.ifc; do
+            # libraries/ holds vendored component sources, not deliverable models.
+            [[ "$file" == libraries/* ]] && continue
+            echo "Validating $file..."
+            python3 -m ifcopenshell.validate --rules "$file"
+          done

.github/workflows/ifc-lint.yml

@@ -1,32 +0,0 @@
-name: IFC Validation
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  lint-ifc:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.x'
-
-      - name: Install ifcopenshell
-        run: |
-          pip install pytest
-          pip install ifcopenshell
-
-      - name: Run IFC lint checks
-        run: |
-          set -e
-          shopt -s globstar nullglob
-          for file in **/*.ifc; do
-            echo "Validating $file..."
-            python3 -m ifcopenshell.validate --rules "$file"
-          done