From 84301e9a3b59f1c3fa10c938b4948a393c7262a1 Mon Sep 17 00:00:00 2001
From: Lucas Ramage <lucas.ramage@infinite-omicron.com>
Date: Fri, 18 Sep 2026 12:19:03 -0500
Subject: [PATCH] ci: add a shellcheck job for shell scripts

Scoped to files changed in each push/PR, not the whole tree. A full
scan finds 816 pre-existing issues across test/*.sh, mostly info/style
level, which would block every PR on unrelated legacy content. Follows
the same diff-scoping approach as proot-rs's own shellcheck job,
extended to also cover .bash and .bats. proot-rs's own \.sh$ filter
misses both, and would have caught neither of the two real bugs
(SC2145, SC2128) found in this session's own test/helper.bash.

shellcheck lints whole files, not just changed lines, so touching any
legacy .sh file surfaces that file's full existing backlog. Checked
the files most likely to get touched soon: test-chroot01.sh has 2
pre-existing issues, test-tempdire.sh has 12, the three
test-socket*.sh have none. Not blocking today, but worth knowing
before someone picks up one of the known-flaky tests next.
---
 .github/workflows/pull-request.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 0136ce36..c77b158d 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -8,6 +8,34 @@ on:
     types: [opened, synchronize, reopened]
 
 jobs:
+  shellcheck:
+    name: shellcheck
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v3
+        with:
+          fetch-depth: 0
+
+      - name: Install shellcheck
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -qq shellcheck
+
+      - name: Lint changed shell scripts
+        run: |
+          if [ "$GITHUB_BASE_REF" ]; then
+            before_commit="${{ github.event.pull_request.base.sha }}"
+          elif [ "${{ github.event.before }}" = "0000000000000000000000000000000000000000" ]; then
+            before_commit="$(git rev-parse HEAD~1)"
+          else
+            before_commit="${{ github.event.before }}"
+          fi
+
+          git diff --name-only --diff-filter=d "${before_commit}..${GITHUB_SHA}" \
+            | grep -E '\.(sh|bash|bats)$' \
+            | xargs --no-run-if-empty shellcheck
+
   build:
     name: "${{ matrix.SECCOMP == '1' && 'seccomp' || 'no-seccomp' }} | ${{ matrix.os }}"
     runs-on: ${{ matrix.os }}