Add shellcheck CI

[sobolevn]

Summary

I started learning uv by inspecting the source code.
I've noticed that your shell scripts are very good! Which is rare!

Test Plan

I propose to add shellcheck to the CI.
It is a great tool to help finding bugs and style issues in shell code.

Techincal details:

• This CI job will only run when any .sh files are changed (or the job definition file)
• It takes just several seconds even on local machine:

» time shellcheck -S style **/*.sh
shellcheck -S style **/*.sh  0.02s user 0.05s system 61% cpu 0.123 total

• It is easy to use, for example: I just fixed the single problem you had in your code with # shellcheck disable=SC1091
• I am using this tool for around 8 years now and didn't have any issues. Examples: https://github.com/sobolevn/git-secret/blob/ca899f3b694187f9027161f537414422ee99c483/.github/workflows/test.yml#L22-L27 and https://github.com/wemake-services/wemake-django-template/blob/master/.github/workflows/shellcheck.yml

But, I understand that build / lint tools are very subjective. So, feel free to close :)

[zanieb]

I do really like shellcheck but given it didn't find any actual problems here I'm not sure if it's worth adding to CI?

If we do add it, it'd probably make sense at

uv/.github/workflows/ci.yml

Line 47 in 14507a1

lint:

with our other lint jobs.

[sobolevn]

@zanieb this is exactly right time to add a tool, when there are no complaints! 😄
Because in other cases - it would be a much harder case, since it would require a refactoring of existing problems.

I added this a separate file, because I can specify to only run this on *.sh files to save some extra computation, when regular PRs don't touch shell scripts.

[zanieb]

How long does it take to run on the full repository? Seconds right? I'm not sure it's worth the time saving — spinning up GitHub Actions runners has significant overhead.

[sobolevn]

Locally it takes 0.02s user 0.05s system 61% cpu 0.123 total, sure, will change to work in lint: job 👍

[mkniewallner]

It would probably be nice to pin a specific shellcheck version to use, per https://github.com/ludeeus/action-shellcheck?tab=readme-ov-file#run-a-specific-version-of-shellcheck. Otherwise if new versions that update or add rules are published, CI could break out of the blue.

By enabling https://docs.renovatebot.com/presets-customManagers/#custommanagersgithubactionsversions preset here and setting something like:

env:
  # renovate: datasource=github-tags depName=koalaman/shellcheck
  SHELLCHECK_VERSION: "v0.10.0"

in the GitHub Actions workflow, it should even be possible to have Renovate regularly update shellcheck version.

[sobolevn]

Awesome! I didn't know that!