ci(lint): add shell linter - Differential ShellCheck

[jamacku]

Description

Addition of a new job in CI workflow that will Scan all shell scripts in the repo using ShellCheck and report only newly added defects.

Motivation and Context

Differential ShellCheck is a GitHub action that performs differential ShellCheck scans on shell scripts changed via PR and reports results directly in PR.

It's great for projects with a greater number of ShellCheck defects where it's not feasible to fix or mask all of them. I see that you have an allow-list of files that can be scanned because they are free of ShellCheck defects. But from what I can see when someone changes a script that is not on the list, CI won't check the changes. But when running ShellCheck scans differentially, you can scan all shell scripts, and only new defects will be reported.

It is able to produce reports in SARIF format. GitHub understands this format and is able to display it nicely as a PR comment, and on the Files Changed tab, please see below.

Documentation is available at @redhat-plumbers-in-action/differential-shellcheck. Let me know If you are missing some feature or option. I'm always happy to extend functionality.

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• If my change requires a change to the documentation, I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• If I have added a new file, I also added it to clean_files.txt and formatted it using lint_clean_files.sh.
• I have added tests to cover my changes, and all the new and existing tests pass.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[jamacku]

Here you can see the summary for PR: https://github.com/Bash-it/bash-it/actions/runs/8174624870#summary-22349834100

If merged, you will see all existing ShellCheck defects under the Security tab in GitHub UI, but they won't be reported in PRs; only newly introduced defects will be reported.