BUG: pinned-dependencies complaining about a bash file

[godofredoc]

Describe the bug

Getting an alert in a bash shell file and I'm not sure if it is intended or a bug in the parsing logic. The link to the file is vars.sh

pinned Info: Dockerfile dependencies  are pinned Info: no insecure (not pinned by hash) dependency  downloads found in Dockerfiles.

Debug: error parsing shell code:  
 tools/fuchsia/devshell/lib/vars.sh:8:22: parameter expansion requires a literal Info: no insecure (not pinned by hash) dependency downloads found in GitHub workflows

Reproduction steps
Steps to reproduce the behavior:

1. docker run -e GITHUB_AUTH_TOKEN=$TOKEN gcr.io/openssf/scorecard:v4.1.0@sha256:a1e9bb4a0976e800e977c986522b0e1c4e0466601642a84470ec1458b9fa6006 --show-details --repo=https://github.com/flutter/engine --verbosity=debug --checks=Pinned-Dependencies

Expected behavior
Unsure but I would expect the file name to show up in the alert to make it more actionable if the alert is intended.

Additional context
N/A

[godofredoc]

\cc @Drewroen @sealesj

[Drewroen]

Cc: @drewroengoogle

[laurentsimon]

This seems to be a parsing error in the shell parser we use: I've created mvdan/sh#854 for tracking.
We're not properly ignoring parsing errors on our side, I've sent #1878 to fix.

Thanks for the report