ci: add shellcheck/actionlint/scalafmt flake checks

Adds three new `nix flake check` entries:
- shellcheck on bin/*.sh
- actionlint on .github/workflows/*.yml (which itself runs shellcheck
  against `run:` script bodies)
- scalafmt --check across the whole project source tree (a writable
  copy is made and `git init` ed so that `.scalafmt.conf`'s
  `project.git = true` works)

To unblock the new checks, fix the existing shellcheck findings in
bin/*.sh and ci.yml: quote variables, drop a dead `ARGS=$@` line,
and add a couple of in-line `# shellcheck disable=SC2016` directives
where we intentionally use single quotes to defer expansion to the
inner shell.

Author: jupblb

.github/workflows/ci.yml

@@ -52,11 +52,11 @@ jobs:
           set -eu
           check_repo() {
             REPO=$1
-            mkdir -p .repos/$REPO
-            git clone https://github.com/$REPO.git .repos/$REPO && cd .repos/$REPO && git submodule update --init
+            mkdir -p ".repos/$REPO"
+            git clone "https://github.com/$REPO.git" ".repos/$REPO" && cd ".repos/$REPO" && git submodule update --init
 
-            docker run -v $PWD/.repos/$REPO:/sources -w /sources sourcegraph/scip-java:latest scip-java index
-            file .repos/$REPO/index.scip || (echo "$REPO SCIP index doesn't exist!"; exit 1)
+            docker run -v "$PWD/.repos/$REPO:/sources" -w /sources sourcegraph/scip-java:latest scip-java index
+            file ".repos/$REPO/index.scip" || (echo "$REPO SCIP index doesn't exist!"; exit 1)
           }
 
           sudo apt install parallel
@@ -97,14 +97,16 @@ jobs:
       - uses: DeterminateSystems/magic-nix-cache-action@v13
 
       - run: nix develop --command sbt build
-      - run: echo "$PWD/out/bin" >> $GITHUB_PATH
+      - run: echo "$PWD/out/bin" >> "$GITHUB_PATH"
       - name: Auto-index scip-java codebase
         run: |
+          # shellcheck disable=SC2016
           nix develop --command bash -c \
             'scip-java index --build-tool=bazel --bazel-scip-java-binary=$(which scip-java)'
       - run: du -h index.scip
       - name: Auto-index example/bazel-workspace
         run: |
+          # shellcheck disable=SC2016
           nix develop "$GITHUB_WORKSPACE" --command bash -c \
             'scip-java index --build-tool=bazel --bazel-scip-java-binary=$(which scip-java)'
         working-directory: examples/bazel-example
@@ -169,21 +171,21 @@ jobs:
 
       - run: |
           nix develop .#jdk${{ matrix.java }} --command sbt build publishM2 publishLocal dumpScipJavaVersion
-          echo "SCIP_JAVA_VERSION=$(cat VERSION)" >> $GITHUB_ENV
-          echo "SCIP_JAVA_CLI=$PWD/out/bin/scip-java" >> $GITHUB_ENV
+          echo "SCIP_JAVA_VERSION=$(cat VERSION)" >> "$GITHUB_ENV"
+          echo "SCIP_JAVA_CLI=$PWD/out/bin/scip-java" >> "$GITHUB_ENV"
 
       - run: |
           nix develop "$GITHUB_WORKSPACE#jdk${{ matrix.java }}" --command \
-            mvn clean verify -DskipTests -Dscip-java.version=$SCIP_JAVA_VERSION sourcegraph:sourcegraphDependencies
+            mvn clean verify -DskipTests "-Dscip-java.version=$SCIP_JAVA_VERSION" sourcegraph:sourcegraphDependencies
         working-directory: examples/maven-example
 
-      - run: nix develop "$GITHUB_WORKSPACE#jdk${{ matrix.java }}" --command $SCIP_JAVA_CLI index-semanticdb target/semanticdb-targetroot
+      - run: nix develop "$GITHUB_WORKSPACE#jdk${{ matrix.java }}" --command "$SCIP_JAVA_CLI" index-semanticdb target/semanticdb-targetroot
         working-directory: examples/maven-example
 
       - run: |
           set -e
           grep org.hamcrest target/semanticdb-targetroot/*dependencies.txt
-          grep $PWD/src/main/java target/semanticdb-targetroot/*dependencies.txt
+          grep "$PWD/src/main/java" target/semanticdb-targetroot/*dependencies.txt
         working-directory: examples/maven-example
 
       - run: du -h index.scip

bin/packagehub.sh

@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-/packagehub --host 0.0.0.0 --port $PORT --src /src --coursier /coursier --postgres.username=$DB_USER --postgres.password=$DB_PASS --postgres.url=$DB_URL
+/packagehub --host 0.0.0.0 --port "$PORT" --src /src --coursier /coursier --postgres.username="$DB_USER" --postgres.password="$DB_PASS" --postgres.url="$DB_URL"

bin/scip-java-docker-script.sh

@@ -12,12 +12,10 @@ if test -f "$FILE"; then
 	fi
 fi
 
-JVM_VERSIONS=$(echo $JVM_VERSION | tr "," "\n")
+JVM_VERSIONS=$(echo "$JVM_VERSION" | tr "," "\n")
 
 LAST_CODE="-1"
 
-ARGS=$@
-
 for JVM_VERSION in $JVM_VERSIONS
 do 
 	if [ "$LAST_CODE" != "0" ]; then

flake.nix

@@ -41,6 +41,10 @@
       in
       {
         checks = {
+          actionlint = pkgs.runCommand "check-actionlint" { } ''
+            ${pkgs.actionlint}/bin/actionlint ${./.github/workflows}/*.yml
+            touch $out
+          '';
           nixfmt = pkgs.runCommand "check-nixfmt" { } ''
             ${pkgs.nixfmt}/bin/nixfmt --check ${./flake.nix}
             touch $out
@@ -50,6 +54,18 @@
               ${./.github/renovate.json}
             touch $out
           '';
+          scalafmt = pkgs.runCommand "check-scalafmt" { buildInputs = [ pkgs.git ]; } ''
+            cp -r ${./.}/. .
+            chmod -R u+w .
+            git init -q
+            git add -A
+            HOME=$(mktemp -d) ${pkgs.scalafmt}/bin/scalafmt --check --non-interactive
+            touch $out
+          '';
+          shellcheck = pkgs.runCommand "check-shellcheck" { } ''
+            ${pkgs.shellcheck}/bin/shellcheck ${./bin}/*.sh
+            touch $out
+          '';
         };
 
         devShells = {