shellcheck.yml

---
name: ShellCheck

# yamllint disable-line rule:truthy
on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  shellcheck:
    name: ShellCheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Detect changed shell scripts
        id: changed
        if: github.event_name == 'pull_request'
        uses: step-security/changed-files@v47.0.5
        with:
          files: '**/*.sh'

      - name: Run ShellCheck
        if: github.event_name != 'pull_request' || steps.changed.outputs.any_changed == 'true'
        uses: ludeeus/action-shellcheck@2.0.0

  # ===========================================================================
  # Gate — required status check for branch protection
  # ===========================================================================
  all-checks-passed:
    name: ShellCheck / All checks passed
    runs-on: ubuntu-latest
    needs: shellcheck
    if: always()
    steps:
      - name: Check result
        run: |
          echo "shellcheck: ${{ needs.shellcheck.result }}"
          case "${{ needs.shellcheck.result }}" in
            success|skipped) exit 0 ;;
            *) exit 1              ;;
          esac
...