ci(shellcheck): add PR shell script linting

.github/workflows/shellcheck.yml

@@ -0,0 +1,43 @@
+name: ShellCheck
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    name: ShellCheck scripts
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout repository
+        # actions/checkout v4, pinned to the tag target so this workflow does not add a mutable release action.
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          fetch-depth: 1
+
+      - name: Install ShellCheck
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends shellcheck
+          shellcheck --version
+
+      - name: Run ShellCheck
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          mapfile -t scripts < <(git ls-files 'scripts/*.sh')
+          if [[ "${#scripts[@]}" -eq 0 ]]; then
+            echo "No shell scripts found."
+            exit 0
+          fi
+
+          printf 'Checking %s shell script(s):\n' "${#scripts[@]}"
+          printf ' - %s\n' "${scripts[@]}"
+          shellcheck "${scripts[@]}"

scripts/create_flash_boot.sh

@@ -377,7 +377,7 @@ if [[ "${PERSIST_READY:-0}" != "1" ]]; then
 fi
 
 if compgen -G "${ZIP_DIR}/unRAIDServer-*-x86_64.zip" > /dev/null; then
-    ZIP_FILE="$(ls -1 "${ZIP_DIR}"/unRAIDServer-*-x86_64.zip | sort -V | tail -n1)"
+    ZIP_FILE="$(find "$ZIP_DIR" -maxdepth 1 -type f -name 'unRAIDServer-*-x86_64.zip' -print | sort -V | tail -n1)"
 else
     error_msg "ERROR: no unRAIDServer zip files found in ${ZIP_DIR}"
     exit 1

scripts/create_internal_boot_user.sh

@@ -747,7 +747,7 @@ if [[ "${PERSIST_READY:-0}" != "1" ]]; then
 fi
 
 if compgen -G "${ZIP_DIR}/unRAIDServer-*-x86_64.zip" > /dev/null; then
-    ZIP_FILE="$(ls -1 "${ZIP_DIR}"/unRAIDServer-*-x86_64.zip | sort -V | tail -n1)"
+    ZIP_FILE="$(find "$ZIP_DIR" -maxdepth 1 -type f -name 'unRAIDServer-*-x86_64.zip' -print | sort -V | tail -n1)"
 else
     error_msg "ERROR: no unRAIDServer zip files found in ${ZIP_DIR}"
     exit 1

scripts/menu_gui_common.sh

@@ -58,14 +58,15 @@ ui_set_dims() {
     local default_2="$3"
     local default_3="${4:-}"
     local dims
+    local dim_1 dim_2 dim_3
 
     dims="$(ui_calc_dims "$kind" 2>/dev/null || true)"
-    set -- $dims
+    read -r dim_1 dim_2 dim_3 <<< "$dims"
 
-    UI_DIM_1="${1:-$default_1}"
-    UI_DIM_2="${2:-$default_2}"
+    UI_DIM_1="${dim_1:-$default_1}"
+    UI_DIM_2="${dim_2:-$default_2}"
     if [[ -n "$default_3" ]]; then
-        UI_DIM_3="${3:-$default_3}"
+        UI_DIM_3="${dim_3:-$default_3}"
     fi
 }
 
@@ -291,8 +292,12 @@ do_poweroff() {
     [ -x /sbin/halt ] && exec /sbin/halt -f
     command -v busybox >/dev/null 2>&1 && exec busybox poweroff -f
 
-    [ -w /proc/sys/kernel/sysrq ] && echo 1 > /proc/sys/kernel/sysrq || true
-    [ -w /proc/sysrq-trigger ] && echo o > /proc/sysrq-trigger || true
+    if [ -w /proc/sys/kernel/sysrq ]; then
+        echo 1 > /proc/sys/kernel/sysrq || true
+    fi
+    if [ -w /proc/sysrq-trigger ]; then
+        echo o > /proc/sysrq-trigger || true
+    fi
 
     ui_msg "Power Off" "Unable to power off automatically on this runtime."
     return 1
@@ -307,8 +312,12 @@ do_reboot() {
     [ -x /sbin/shutdown ] && exec /sbin/shutdown -r now
     command -v busybox >/dev/null 2>&1 && exec busybox reboot -f
 
-    [ -w /proc/sys/kernel/sysrq ] && echo 1 > /proc/sys/kernel/sysrq || true
-    [ -w /proc/sysrq-trigger ] && echo b > /proc/sysrq-trigger || true
+    if [ -w /proc/sys/kernel/sysrq ]; then
+        echo 1 > /proc/sys/kernel/sysrq || true
+    fi
+    if [ -w /proc/sysrq-trigger ]; then
+        echo b > /proc/sysrq-trigger || true
+    fi
 
     ui_msg "Reboot" "Unable to reboot automatically on this runtime."
     return 1

scripts/zip.sh

@@ -449,7 +449,7 @@ download_file() {
 
   local tmp_out="${out}.part"
   local start_ts elapsed size rate spinner_index spinner_char
-  local spinner='|/-\\'
+  local spinner="|/-\\"
   local gui_status_shown=0
 
   rm -f "$tmp_out"
@@ -647,6 +647,8 @@ if ! command -v php >/dev/null 2>&1; then
 fi
 
 RELEASES_FILE="$(mktemp)"
+# The PHP parser is intentionally single-quoted so the shell does not expand PHP variables.
+# shellcheck disable=SC2016
 php -r '
   $json = json_decode(file_get_contents($argv[1]), true);
   if (!is_array($json)) {