ci: add shellcheck + ruff workflow for shell / Python scripts (#51)

Stretch slice of #34. Adds a path-scoped CI workflow that runs `shellcheck --severity=warning` over all tracked `*.sh` files and `ruff check --output-format=github` over all tracked `*.py` files. Triggers only on `**.sh` / `**.py` / the workflow file itself, so Rust-only diffs don't spin it up.

- New `.github/workflows/scripts.yml` with two jobs (shellcheck, ruff). Both exit cleanly when discovery returns no files.
- New `ruff.toml` pinning `target-version = "py310"` (Jetson Ubuntu 22.04) with one inline-justified ignore for `E402` — the wakeword scripts under `deploy/scripts/` must redirect ALSA/PortAudio stderr before importing pyaudio, otherwise C-level diagnostics leak into the protocol stdout the scripts use to talk to `voice_loop.rs`.
- Ruff pinned to `'ruff==0.6.*'` to avoid minor-version-breakage churn.

Independent of the other #34 PRs.

Author: statxc

.github/workflows/scripts.yml

@@ -0,0 +1,68 @@
+name: Scripts
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "**.sh"
+      - "**.py"
+      - ".github/workflows/scripts.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "**.sh"
+      - "**.py"
+      - ".github/workflows/scripts.yml"
+
+concurrency:
+  group: scripts-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  shellcheck:
+    name: shellcheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install shellcheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends shellcheck
+      - name: Run shellcheck on all .sh files
+        run: |
+          set -euo pipefail
+          mapfile -t files < <(git ls-files '*.sh')
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "no shell scripts to check"
+            exit 0
+          fi
+          printf '%s\n' "${files[@]}"
+          shellcheck --severity=warning "${files[@]}"
+
+  ruff:
+    name: ruff
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install ruff
+        run: pip install --no-cache-dir 'ruff==0.6.*'
+      - name: Discover Python files
+        id: discover
+        run: |
+          set -euo pipefail
+          mapfile -t files < <(git ls-files '*.py')
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "no python files to check"
+            echo "found=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          printf '%s\n' "${files[@]}"
+          echo "found=true" >> "$GITHUB_OUTPUT"
+      - name: ruff check
+        if: steps.discover.outputs.found == 'true'
+        run: ruff check --output-format=github .

CHANGELOG.md

@@ -4,6 +4,18 @@
 
 ### Added
 
+- `.github/workflows/scripts.yml` and `ruff.toml` — shellcheck + ruff
+  workflow for the stretch slice of issue #34. Discovers all
+  tracked `*.sh` and `*.py` files via `git ls-files`, then runs
+  `shellcheck --severity=warning` and `ruff check
+  --output-format=github`. `ruff.toml` pins `target-version = "py310"`
+  (Jetson Ubuntu 22.04) and ignores E402, with an inline comment
+  explaining why: `deploy/scripts/genie-wake-listen.py` and
+  `genie-wakeword.py` legitimately import after redirecting ALSA stderr
+  to `/dev/null` so the C-level diagnostic noise from PyAudio doesn't
+  leak into the protocol stdout. Trigger paths are scoped to `**.sh` /
+  `**.py` / the workflow file itself so Rust-only changes don't spin up
+  this job.
 - First-voice-reply latency banner (issue #19). On the first completed voice
   cycle of a `genie-core` run, the loop prints a one-shot 5-phase breakdown
   from end-of-user-speech to first audible audio:

ruff.toml

@@ -0,0 +1,12 @@
+# Ruff config for genie-claw's helper Python scripts under deploy/scripts/.
+# These scripts target the Python that ships with Jetson's Ubuntu 22.04 image.
+
+target-version = "py310"
+line-length = 100
+
+[lint]
+# E402 (module-level import not at top of file) is intentionally allowed:
+# the wakeword scripts have to suppress ALSA stderr and silence scipy/numpy
+# warnings *before* importing pyaudio / openwakeword, otherwise the C-level
+# diagnostics leak into the protocol stdout.
+ignore = ["E402"]