New test:shellcheck CI job

https://github.com/koalaman/shellcheck is a
static analysis tool for shell scripts.

.gitlab/ci/rules.gitlab-ci.yml

@@ -373,6 +373,10 @@
   - ".dockerignore"
   - "qa/**/*"
 
+.code-shell-patterns: &code-shell-patterns
+  - "bin/**/*"
+  - "tooling/**/*"
+
 # .code-backstage-qa-patterns + .workhorse-patterns
 .setup-test-env-patterns: &setup-test-env-patterns
   - "{package.json,yarn.lock}"
@@ -1775,6 +1779,13 @@
     - changes: *code-backstage-qa-patterns
     - changes: *startup-css-patterns
 
+###############
+# Shell rules #
+###############
+.shell:rules:
+  rules:
+    - changes: *code-shell-patterns
+
 #######################
 # Test metadata rules #
 #######################

.gitlab/ci/static-analysis.gitlab-ci.yml

@@ -107,3 +107,15 @@ feature-flags-usage:
     when: always
     paths:
       - tmp/feature_flags/
+
+shellcheck:
+  extends:
+    - .default-retry
+    - .shell:rules
+  stage: lint
+  needs: []
+  image:
+    name: koalaman/shellcheck-alpine
+    entrypoint: [""]
+  script:
+    - tooling/bin/shellcheck

tooling/bin/shellcheck

+#!/bin/sh
+
+root="$(cd "$(dirname "$0")/../.." || exit ; pwd -P)"
+
+if [ $# -ne 0 ]; then
+	shellcheck --exclude=SC1071 --external-sources "$@"
+else
+	find \
+		"${root}/bin" \
+		"${root}/tooling" \
+		-type f \
+		-not -path "*.swp" \
+		-not -path "*.rb" \
+		-not -path "*.js" \
+		-not -path "*.md" \
+		-not -path "*.haml" \
+		-not -path "*/Gemfile*" \
+		-not -path '*/.bundle*' \
+		-not -path '*/Makefile*' \
+		-print0 \
+	| xargs -0 shellcheck --exclude=SC1071 --external-sources --
+fi