adds shellcheck to ci/cd (#22616)

ci/cd script to shellcheck .sh files and make sure they're executable as
part of cicd so it fails loud with the specific problem if Permissions
Issue 2 The Revengeance happens again

.github/workflows/byond.yml

@@ -69,6 +69,7 @@ jobs:
           bash tools/ci/check_filedirs.sh aurorastation.dme
           bash tools/ci/check_changelogs.sh
           bash tools/ci/check_grep.sh $PWD
+          bash tools/ci/check_shell_scripts.sh
           awk -f tools/indentation.awk **/*.dm
 
       - name: "Check if running CI"

html/changelogs/llywelwyn-sh.yml

@@ -0,0 +1,5 @@
+author: Llywelwyn
+delete-after: True
+changes:
+  - code_imp: "Shellcheck shell scripts in CI/CD."
+  - code_imp: "Fixes shellcheck warns in existing scripts."

tools/ci/check_shell_scripts.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+# Enforces an executable bit and static analysis on shell scripts.
+
+set -uo pipefail
+
+severity="${SHELLCHECK_SEVERITY:-error}"
+status=0
+ok() { printf   '  OK   %s\n' "$1"; }
+fail() { printf '  FAIL %s\n' "$1"; status=1; }
+
+mapfile -t scripts < <(git ls-files '*.sh')
+
+echo "Checking executable bit"
+for f in "${scripts[@]}"; do
+    mode="$(git ls-files -s -- "$f" | awk '{print $1; exit}')"
+    if [ "$mode" = "100755" ]; then ok "$f"; else fail "$f: not executable -> git update-index --chmod=+x '$f'"; fi
+done
+
+if command -v shellcheck >/dev/null 2>&1; then
+    echo "shellcheck (severity=$severity)"
+    for f in "${scripts[@]}"; do
+        if shellcheck --severity="$severity" -- "$f"; then ok "$f"; else status=1; fi
+    done
+else
+    echo "shellcheck not available"
+fi
+
+if [ "$status" -ne 0 ]; then echo "FAIL"; else echo "PASS"; fi
+exit "$status"

tools/requirements-install.sh

@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 if python3 python_version_check.py
 then
     read -p "Press [Enter] to continue..."

tools/tgs_scripts/InstallDeps.sh

@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 
 #find out what we have (+e is important for this)
 set +e