ci: shellcheck checks

.github/workflows/shellcheck.yml

@@ -0,0 +1,19 @@
+name: Shellcheck
+on:
+  pull_request:
+    branches:
+      - master
+jobs:
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Run ShellCheck
+      uses: ludeeus/[email protected]
+      env:
+        SHELLCHECK_OPTS: -x # allow outside sources
+      with:
+        # This code comes directly from upstream libsecp256k1
+        # and should not be linted here.
+        ignore_paths: ./secp256k1-sys/depend/**/*.sh

contrib/_test.sh

@@ -2,7 +2,6 @@
 
 set -ex
 
-REPO_DIR=$(git rev-parse --show-toplevel)
 FEATURES="hashes global-context lowmemory rand recovery serde std alloc"
 
 cargo --version

contrib/test.sh

@@ -22,7 +22,7 @@ fi
 for dep in $DEPS
 do
     cp "Cargo-$dep.lock" Cargo.lock
-    $REPO_DIR/contrib/_test.sh
+    "$REPO_DIR"/contrib/_test.sh
 
     if [ "$dep" = recent ];
     then

githooks/pre-commit

@@ -22,11 +22,13 @@ exec 1>&2
 # Cross platform projects tend to avoid non-ASCII filenames; prevent
 # them from being added to the repository. We exploit the fact that the
 # printable range starts at the space character and ends with tilde.
+# disable the check to quoting the $(...) command
+# shellcheck disable=SC2046
 if [ "$allownonascii" != "true" ] &&
 	# Note that the use of brackets around a tr range is ok here, (it's
 	# even required, for portability to Solaris 10's /usr/bin/tr), since
 	# the square bracket bytes happen to fall in the designated range.
-	test $(git diff --cached --name-only --diff-filter=A -z $against |
+	test $(git diff --cached --name-only --diff-filter=A -z "$against" |
 	  LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
 then
 	cat <<\EOF
@@ -44,7 +46,7 @@ EOF
 fi
 
 # If there are whitespace errors, print the offending file names and fail.
-git diff-index --check --cached $against -- || exit 1
+git diff-index --check --cached "$against" -- || exit 1
 
 # Check that code lints cleanly.
 cargo clippy --features=rand,std,recovery,lowmemory,global-context --all-targets -- -D warnings || exit 1