Create test workflow

Author: jasonkarns

.github/workflows/test.yml

@@ -0,0 +1,48 @@
+name: Test
+on:
+  push:
+  pull_request:
+  schedule: [{ cron: "0 0 10 * *" }] # monthly https://crontab.guru/#0_0_10_*_*
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  test:
+    uses: nodenv/.github/.github/workflows/test.yml@v5
+    with: {superlinter: false} # TODO renable superlinter
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
+      security-events: write
+      statuses: write
+
+  # https://github.com/redhat-plumbers-in-action/differential-shellcheck
+  shellcheck:
+    permissions: {contents: read, security-events: write}
+    runs-on: ubuntu-latest
+    steps:
+    - uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      with: { egress-policy: audit }
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with: {fetch-depth: 0}
+    - uses: redhat-plumbers-in-action/differential-shellcheck@0d9e5b29625f871e6a4215380486d6f1a7cb6cdd # v5.5.5
+      with:
+        severity: error # TODO strengthen
+        token: ${{ secrets.GITHUB_TOKEN }}
+
+  checksums:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      with: { egress-policy: audit }
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with: { fetch-depth: 0 }
+    - run: npm ci
+
+      # FIXME workaround https://github.com/actions/checkout/issues/910
+    - if: github.event_name == 'pull_request'
+      run: npm run lint:checksums -- origin/${{github.base_ref}}
+    - run: npm run lint:checksums -- HEAD^
+      if: github.event_name == 'push'