feat: add shellcheck validation

- Add ShellCheck as npm dependency (v4.1.0)
- Create shellcheck_validate.sh script with paths-filter integration
- Add .shellcheckrc configuration file with Terraform-specific disables
- Integrate ShellCheck step into CI workflow
- Use selective validation based on changed files

Author: DevelopmentCats

.github/workflows/ci.yaml

@@ -29,8 +29,11 @@ jobs:
               - 'scripts/ts_test_auto.sh'
               - 'scripts/terraform_test_all.sh'
               - 'scripts/terraform_validate.sh'
+              - 'scripts/shellcheck_validate.sh'
             modules:
               - 'registry/**/modules/**'
+            shell:
+              - '**/*.sh'
             all:
               - '**'
       - name: Set up Terraform
@@ -64,6 +67,12 @@ jobs:
           SHARED_CHANGED: ${{ steps.filter.outputs.shared }}
           MODULE_CHANGED_FILES: ${{ steps.filter.outputs.modules_files }}
         run: bun terraform-validate
+      - name: Run ShellCheck
+        env:
+          ALL_CHANGED_FILES: ${{ steps.filter.outputs.all_files }}
+          SHARED_CHANGED: ${{ steps.filter.outputs.shared }}
+          SHELL_CHANGED_FILES: ${{ steps.filter.outputs.shell_files }}
+        run: bun shellcheck
   validate-style:
     name: Check for typos and unformatted code
     runs-on: ubuntu-latest

.shellcheckrc

@@ -0,0 +1,20 @@
+# ShellCheck configuration for Coder Registry
+# https://www.shellcheck.net/wiki/
+
+# Set default shell dialect to bash (most scripts use bash)
+shell=bash
+
+# Disable checks that conflict with Terraform templating syntax
+# Many scripts use Terraform's templatefile() function with $${VAR} escape syntax
+disable=SC2154  # Variable is referenced but not assigned (injected by Terraform)
+disable=SC2034  # Variable appears unused (used via $${VAR} syntax)
+disable=SC1083  # Literal braces (Terraform's $${VAR} escape syntax)
+disable=SC2193  # Comparison arguments never equal (Terraform interpolation)
+disable=SC2125  # Brace expansion/globs in assignments (Terraform syntax)
+
+# Disable checks that conflict with common bash idioms
+disable=SC2076  # Quoted regex in =~ (intentional for literal string matching with space padding)
+
+# Enable all optional checks for thorough analysis
+enable=all
+