chore: import upstream snapshot with attribution

2026-07-13 12:31:33 +08:00
commit 9e8f1bbeed
1156 changed files with 235330 additions and 0 deletions
@@ -0,0 +1,81 @@
+name: ShellCheck
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    name: Lint shell scripts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install ShellCheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+          shellcheck --version
+
+      - name: Run ShellCheck on ods shell scripts
+        run: |
+          # Find all .sh files under ods/
+          shfiles=$(find ods/ -name '*.sh' -type f)
+
+          if [ -z "$shfiles" ]; then
+            echo "No .sh files found under ods/"
+            exit 0
+          fi
+
+          echo "Found $(echo "$shfiles" | wc -l) shell scripts"
+          echo ""
+
+          # Run shellcheck:
+          #   -e SC1091  exclude "can't follow sourced files"
+          #   -e SC2034  exclude "unused variables" (many are used by sourced files)
+          #   -S warning treat warnings and above as reportable
+          # shellcheck returns:
+          #   0 = no issues
+          #   1 = errors or warnings found
+          # We fail the job only on error-severity issues by using -S error,
+          # but still display warnings for visibility.
+
+          # First pass: display all warnings and errors for visibility
+          echo "=== ShellCheck results (warnings + errors) ==="
+          echo "$shfiles" | xargs shellcheck \
+            --exclude=SC1091,SC2034 \
+            --severity=warning \
+            --format=gcc \
+            || true
+
+          echo ""
+          echo "=== Checking for error-severity issues (will fail if found) ==="
+
+          # Second pass: fail only on error severity
+          echo "$shfiles" | xargs shellcheck \
+            --exclude=SC1091,SC2034 \
+            --severity=error
+
+      - name: Regression guard - no http://localhost in shell scripts
+        run: |
+          # IPv6 ::1 resolution can hang on macOS; always use 127.0.0.1 in
+          # shell scripts. Excludes: demo-offline.sh (echo'd documentation,
+          # never executed) and test-extension-audit.sh (heredoc compose YAML
+          # fixtures with container-internal localhost).
+          # Note: extensionless scripts (e.g. ods-cli) are not scanned by
+          # this glob; coverage is limited to *.sh / *.bash. ods-cli's
+          # localhost sites were handled by the earlier localhost-to-127.0.0.1 sweep.
+          matches=$(find ods -type f \( -name '*.sh' -o -name '*.bash' \) \
+            ! -path 'ods/scripts/demo-offline.sh' \
+            ! -path 'ods/tests/test-extension-audit.sh' \
+            -exec grep -nE 'curl[^|]*http://localhost:' {} + || true)
+          if [ -n "$matches" ]; then
+            echo "::error::curl http://localhost: detected; use 127.0.0.1 (IPv6 ::1 resolution can hang on macOS):"
+            echo "$matches"
+            exit 1
+          fi