Suppress SC2016 for literal behavior-defined engine configs

pkg/workflow/behavior_defined_engine.go

@@ -674,17 +674,21 @@ func (e *BehaviorDefinedEngine) buildConfigFileStep() GitHubActionStep {
 		return nil
 	}
 	config := behavior.ConfigFile
+	shellcheckDirective := ""
+	if strings.Contains(config.Content, "$") {
+		shellcheckDirective = "# shellcheck disable=SC2016\n"
+	}
 	command := fmt.Sprintf(`umask 077
 mkdir -p "$(dirname "$GITHUB_WORKSPACE/%s")"
 CONFIG="$GITHUB_WORKSPACE/%s"
-BASE_CONFIG='%s'
+%sBASE_CONFIG='%s'
 if [ -f "$CONFIG" ]; then
   MERGED=$(jq -n --argjson base "$BASE_CONFIG" --argjson existing "$(cat "$CONFIG")" '$existing * $base')
   echo "$MERGED" > "$CONFIG"
 else
   echo "$BASE_CONFIG" > "$CONFIG"
 fi
-chmod 600 "$CONFIG"`, config.Path, config.Path, config.Content)
+chmod 600 "$CONFIG"`, config.Path, config.Path, shellcheckDirective, config.Content)
 	if config.MergeStrategy != behaviorConfigMergeJSON {
 		command = fmt.Sprintf(`umask 077
 mkdir -p "$(dirname "$GITHUB_WORKSPACE/%s")"

pkg/workflow/behavior_defined_engine_harness_test.go

@@ -208,6 +208,30 @@ func TestBehaviorDefinedEngineNoHarnessScript(t *testing.T) {
 	assert.NotContains(t, execStepContent, "GHAW_HARNESS_SCRIPT_EOF", "no harness write step should be present")
 }
 
+func TestBehaviorDefinedEngineConfigFileDisablesSC2016(t *testing.T) {
+	def := &EngineDefinition{
+		ID:          "config",
+		DisplayName: "Config",
+		Behaviors: &EngineBehaviorDefinition{
+			ConfigFile: &EngineConfigFileDefinition{
+				Path:          ".config.json",
+				StepName:      "Write Config",
+				Content:       `{"$schema":"https://example.com/schema.json"}`,
+				MergeStrategy: behaviorConfigMergeJSON,
+			},
+		},
+	}
+	engine, err := NewBehaviorDefinedEngine(def)
+	require.NoError(t, err)
+
+	step := strings.Join(engine.buildConfigFileStep(), "\n")
+	assert.Contains(t, step, "# shellcheck disable=SC2016\n          BASE_CONFIG=")
+
+	def.Behaviors.ConfigFile.Content = `{"option":true}`
+	step = strings.Join(engine.buildConfigFileStep(), "\n")
+	assert.NotContains(t, step, "# shellcheck disable=SC2016")
+}
+
 // TestBehaviorDefinedEngineRenderMCPConfig verifies that the MCP gateway startup command
 // is always emitted, even for engines that declare no behaviors.mcp.config-path (e.g.
 // engines with `mcp: false`). Skipping it would leave the gateway container unstarted