ci: lint shell scripts with shellcheck

Author: PierreJeanjacquot

CONTRIBUTING.md

@@ -16,7 +16,7 @@ CI enforces this on every pull request via `bash scripts/compute-workflow-sha256
 
 ## Linting
 
-Workflows are linted with [actionlint](https://github.com/rhysd/actionlint), which also runs [shellcheck](https://github.com/koalaman/shellcheck) on `run:` scripts. Both tools are pinned in `mise.toml` and `mise.lock`. Install them with [mise](https://mise.jdx.dev):
+Workflows are linted with [actionlint](https://github.com/rhysd/actionlint), which also runs [shellcheck](https://github.com/koalaman/shellcheck) on inline `run:` scripts. Shell scripts committed to the repository (`*.sh`, e.g. under `scripts/`) are linted with shellcheck directly. Both tools are pinned in `mise.toml` and `mise.lock`. Install them with [mise](https://mise.jdx.dev):
 
 ```sh
 mise install --locked

mise.toml

@@ -9,5 +9,9 @@ lockfile = true
 [tasks."lint:actionlint"]
 run = "actionlint"
 
+[tasks."lint:shellcheck"]
+shell = "bash -euo pipefail -c"
+run = "git ls-files -z --cached --others --exclude-standard '*.sh' | xargs -0 -r shellcheck"
+
 [tasks.lint]
-depends = [ "lint:actionlint" ]
+depends = [ "lint:actionlint", "lint:shellcheck" ]

scripts/check-release-please-config.sh

@@ -40,6 +40,7 @@ fi
 # --- root key ordering: $schema first, lexicographic, packages last ---
 mapfile -t root_keys < <(jq -r 'keys_unsorted[]' "$CONFIG")
 
+# shellcheck disable=SC2016 # literal key name, not an expansion
 if [[ "${root_keys[0]-}" != '$schema' ]]; then
   say_err "root key order: first key must be \"\$schema\" (got \"${root_keys[0]-<none>}\")"
   ((failures += 1))
@@ -52,6 +53,7 @@ fi
 
 mid_keys=()
 for k in "${root_keys[@]}"; do
+  # shellcheck disable=SC2016 # literal key name, not an expansion
   [[ "$k" == '$schema' || "$k" == 'packages' ]] && continue
   mid_keys+=("$k")
 done

scripts/compute-workflow-sha256.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -uo pipefail
 
-cd "$(dirname "$0")/.."
+cd "$(dirname "$0")/.." || exit 1
 
 check=false
 if [[ "${1:-}" == "--check" ]]; then