Add CI workflow with shellcheck, bash -n, and bats gates

GitHub Actions workflow on pull_request and push to main / dev with two jobs:

  - lint: runs shellcheck at warning severity and bash -n on every .sh file in the repo

  - bats: installs bats jq curl python3 and runs the test suite

Pinned ubuntu-24.04 runner. actions/checkout pinned to commit SHA 34e114876b0b11c390a56381ad16ebd13914f8d5 (v4.3.1) for supply-chain hygiene; persist-credentials false drops the GITHUB_TOKEN from local git after checkout. permissions: contents read at workflow level. 10-minute timeout per job.

Verified locally by replicating the workflow steps inside a clean docker run --rm ubuntu:24.04 container; all 25 bats tests pass and shellcheck reports zero warnings.

Author: d4rken

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main, dev]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: shellcheck + bash -n
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Install shellcheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+
+      - name: Run shellcheck (warning severity)
+        run: |
+          find . -name '*.sh' -not -path './.git/*' -print0 \
+            | xargs -0 shellcheck -S warning
+
+      - name: Run bash syntax check
+        run: |
+          find . -name '*.sh' -not -path './.git/*' -print0 \
+            | xargs -0 -n1 bash -n
+
+  test:
+    name: bats
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Install bats, jq, curl, python3
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y bats jq curl python3
+
+      - name: Run bats suite
+        run: bats test/