ci: shellcheck checks

.github/workflows/shellcheck.yml

@@ -0,0 +1,15 @@
+name: Shellcheck
+on:
+  pull_request:
+    branches:
+      - master
+jobs:
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Run ShellCheck
+      uses: ludeeus/[email protected]
+      env:
+        SHELLCHECK_OPTS: -x # allow outside sources

contrib/_test.sh

@@ -2,7 +2,6 @@
 
 set -ex
 
-REPO_DIR=$(git rev-parse --show-toplevel)
 FEATURES="hashes global-context lowmemory rand recovery serde std alloc hashes-std rand-std"
 
 cargo --version

contrib/test.sh

@@ -22,7 +22,7 @@ fi
 for dep in $DEPS
 do
     cp "Cargo-$dep.lock" Cargo.lock
-    $REPO_DIR/contrib/_test.sh
+    "$REPO_DIR"/contrib/_test.sh
 
     if [ "$dep" = recent ];
     then

githooks/pre-commit

@@ -22,11 +22,13 @@ exec 1>&2
 # Cross platform projects tend to avoid non-ASCII filenames; prevent
 # them from being added to the repository. We exploit the fact that the
 # printable range starts at the space character and ends with tilde.
+# disable the check to quoting the $(...) command
+# shellcheck disable=SC2046
 if [ "$allownonascii" != "true" ] &&
 	# Note that the use of brackets around a tr range is ok here, (it's
 	# even required, for portability to Solaris 10's /usr/bin/tr), since
 	# the square bracket bytes happen to fall in the designated range.
-	test $(git diff --cached --name-only --diff-filter=A -z $against |
+	test $(git diff --cached --name-only --diff-filter=A -z "$against" |
 	  LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
 then
 	cat <<\EOF
@@ -44,7 +46,7 @@ EOF
 fi
 
 # If there are whitespace errors, print the offending file names and fail.
-git diff-index --check --cached $against -- || exit 1
+git diff-index --check --cached "$against" -- || exit 1
 
 # Check that code lints cleanly.
 cargo clippy --features=rand-std,recovery,lowmemory,global-context --all-targets -- -D warnings || exit 1

secp256k1-sys/depend/secp256k1/ci/ci.sh

@@ -80,7 +80,7 @@ esac
     --enable-examples="$EXAMPLES" \
     --enable-ctime-tests="$CTIMETESTS" \
     --with-valgrind="$WITH_VALGRIND" \
-    --host="$HOST" $EXTRAFLAGS
+    --host="$HOST" "$EXTRAFLAGS"
 
 # We have set "-j<n>" in MAKEFLAGS.
 build_exit_code=0
@@ -100,7 +100,7 @@ if [ $build_exit_code -ne 0 ]; then
 fi
 
 # Print information about binaries so that we can see that the architecture is correct
-file *tests* || true
+file ./*tests* || true
 file bench* || true
 file .libs/* || true