Support recursive glob patterns (`**`) — enable `globstar`

[AnHeuermann]

Is your feature request related to a problem?

The pattern input cannot match a specific filename at an arbitrary directory
depth (e.g. **/my-xml-file.xml).

The validate steps expand the pattern via unquoted bash pathname expansion:

action.yml#L180-L186:

- name: 'Validate against local schema'
  env:
    GLOB_PATTERN: ${{ inputs.pattern }}
    XSD_FILE: ${{ inputs.xsd-file }}
  shell: bash
  run: xmllint --noout --schema "$XSD_FILE" $GLOB_PATTERN

The action never enables globstar, and GitHub Actions runs shell: bash as
bash --noprofile --norc -eo pipefail, where globstar is off by default.
As a result ** collapses to a single * and only matches one path segment.

So pattern: '**/my-xml-file.xml' behaves like */my-xml-file.xml and
matches only files exactly one directory deep — there is currently no way to
validate all files with a given name regardless of depth.

Describe the solution you'd like

Enable recursive globbing before expanding $GLOB_PATTERN, e.g. add
shopt -s globstar to the validation (and List files) steps.

Given this tree:

.
├── my-xml-file.xml
├── first-dir
│   └── my-xml-file.xml
└── second-dir
    └── nested-dir
        └── my-xml-file.xml

With pattern: '**/my-xml-file.xml':

• Should be flagged / validated (all of them):
  my-xml-file.xml, first-dir/xml/my-xml-file.xml,
  second-dir/nested-dir/my-xml-file.xml
• Currently matched (bug): none of the two-level-deep files; only a
  hypothetical */my-xml-file.xml at exactly one level.

It would also help to set nullglob (or failglob) so a pattern that matches
nothing produces a clear message instead of passing the literal, unexpanded
pattern string to xmllint as a filename.

Additional context (optional)

• Affected steps in action.yml: List files, Validate for well-formedness,
  Validate against local schema, Validate against downloaded remote schema.

• Docs currently advertise glob support ("path/to/*/docs/*.xml") but do not
  state that recursive ** is unsupported, which is surprising.

• I intend to create a pull request to implement this feature.
  Or at least I would let run an AI agent and see if produces an acceptable solution + test.

[jrfnl]

@AnHeuermann Thanks for reporting this. Interesting find and analysis.

• Are there any security implications of enabling recursive globbing ?
• Can this be turned off again after the particular step in which it is used ? (To not affect other steps in workflows in which this action runner is being used)

Also, before continuing, please be aware that GenAI PRs are NOT acceptable across this organisation. Anything touched by AI will be closed without discussion.

[AnHeuermann]

Are there any security implications of enabling recursive globbing ?

Only the obvious ones already here: Patterns aren't sanitized, so users of the action can already inject whatever command they like by changing pattern to e.g., *.xml && do-stuff. Recursive globing won't change that.

Can this be turned off again after the particular step in which it is used ? (To not affect other steps in workflows in which this action runner is being used)

Probably depends on the implementation. My proposed change only affected the active bash environment of the affected stage. So no, I'm very sure it is impossible for shopt -s globstar to leak out of a run inside a step.

Also, before continuing, please be aware that GenAI PRs are NOT acceptable across this organisation. Anything touched by AI will be closed without discussion.

Sorry, I must have missed that part form the contributions guidelines / code of conduct of this repo.
But in that case I can't provide a PR.