ci: add shellcheck step for raw shell scripts

Discovers files by shebang under scripts/ rather than a *.sh glob, so
extensionless scripts (scripts/pre-push) and any future additions are
covered without editing the workflow. Runs at -S warning: the repo's
one existing finding (SC2016 on an intentionally single-quoted awk
program) is info-level and correct as written, so it's excluded by
severity rather than silenced with a disable comment.

Refs #4429

.forgejo/workflows/ci.yml

@@ -56,6 +56,26 @@ jobs:
       - name: lint
         run: sh scripts/check-attribution-trailers.sh
 
+  shellcheck:
+    name: shellcheck
+    runs-on: [hive-ci]
+    # shellcheck itself is fast; nix shell's first pull of the closure is
+    # the slow part on a cold cache.
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v3
+      - name: lint
+        # Discovers raw shell files by shebang rather than by extension —
+        # scripts/pre-push ships with no `.sh` suffix, so a `*.sh` glob
+        # would silently skip it (and any future extensionless script).
+        # -S warning drops info-level notes: the repo's one SC2016 hit is
+        # an intentionally single-quoted awk program, not a bug, and this
+        # keeps the gate free of a disable-comment for it while still
+        # failing on anything warning-or-worse.
+        run: |
+          files=$(grep -lE '^#!.*/(env[[:space:]]+)?(ba)?sh([[:space:]]|$)' scripts/* 2>/dev/null)
+          echo "$files" | xargs nix develop -c shellcheck -S warning
+
   prose-lint:
     name: prose lint (vale)
     runs-on: [hive-ci]