test: Add GHA for shellcheck

.github/workflows/test-shell.yaml

@@ -0,0 +1,37 @@
+name: Check shell scripts
+
+on:
+  push:
+    branches:
+      - main
+      - test/**
+      - release/**
+    tags:
+      - v*
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "docker-pussh"
+      - "**.sh"
+
+jobs:
+  shellcheck:
+    name: Run Shellcheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install Shellcheck via mise
+        uses: jdx/mise-action@13abe502c30c1559a5c37dff303831bab82c9402 # v2.2.3
+        with:
+          version: "2025.6.5"
+          install_args: "shellcheck"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Find and lint bash scripts
+        run: |
+          make shellcheck

.mise.toml

@@ -1,2 +1,3 @@
 [tools]
 go = "1.24"
+shellcheck = "0.10.0"

Makefile

@@ -1,3 +1,7 @@
+.PHONY: install-docker-plugin
 install-docker-plugin:
 	cp docker-pussh ~/.docker/cli-plugins/docker-pussh
 
+.PHONY: shellcheck
+shellcheck:
+	find . -type f \( -name "docker-pussh" -o -name "*.sh" \) -print0 | xargs -0 shellcheck;

docker-pussh

@@ -81,12 +81,12 @@ ssh_remote() {
     fi
 
     local ssh_opts=(
-        -o ControlMaster=auto
+        -o "ControlMaster=auto"
         # Unique control socket path for this invocation.
         -o "ControlPath=/tmp/docker-pussh-$$.sock"
         # The connection will be automatically terminated after 1 minute of inactivity.
-        -o ControlPersist=1m
-        -o ConnectTimeout=15
+        -o "ControlPersist=1m"
+        -o "ConnectTimeout=15"
     )
     # Add port if specified
     if [ -n "$port" ]; then
@@ -149,6 +149,7 @@ run_unregistry() {
 
     # Pull unregistry image if it doesn't exist on the remote host. This is done separately to not capture the output
     # and print the pull progress to the terminal.
+    # shellcheck disable=SC2029
     if ! ssh "${SSH_ARGS[@]}" "$REMOTE_SUDO docker image inspect $UNREGISTRY_IMAGE" >/dev/null 2>&1; then
         ssh "${SSH_ARGS[@]}" "$REMOTE_SUDO docker pull $UNREGISTRY_IMAGE"
     fi
@@ -157,6 +158,7 @@ run_unregistry() {
         UNREGISTRY_PORT=$(random_port)
         UNREGISTRY_CONTAINER="unregistry-pussh-$$-$UNREGISTRY_PORT"
 
+        # shellcheck disable=SC2029
         if output=$(ssh "${SSH_ARGS[@]}" "$REMOTE_SUDO docker run -d \
             --name $UNREGISTRY_CONTAINER \
             -p 127.0.0.1:$UNREGISTRY_PORT:5000 \
@@ -169,6 +171,7 @@ run_unregistry() {
         fi
 
         # Remove the container that failed to start if it was created.
+        # shellcheck disable=SC2029
         ssh "${SSH_ARGS[@]}" "$REMOTE_SUDO docker rm -f $UNREGISTRY_CONTAINER" >/dev/null 2>&1 || true
         # Check if the error is due to port binding.
         if ! echo "$output" | grep -q --ignore-case "bind.*$UNREGISTRY_PORT"; then
@@ -335,6 +338,7 @@ cleanup() {
 
     # Stop and remove unregistry container on remote host.
     if [ -n "$UNREGISTRY_CONTAINER" ]; then
+        # shellcheck disable=SC2029
         ssh "${SSH_ARGS[@]}" "$REMOTE_SUDO docker rm -f $UNREGISTRY_CONTAINER" >/dev/null 2>&1 || true
     fi
 
@@ -382,6 +386,7 @@ if ! docker push ${DOCKER_PUSH_OPTS[@]+"${DOCKER_PUSH_OPTS[@]}"} "$REGISTRY_IMAG
 fi
 
 # Pull image from unregistry if remote Docker doesn't uses containerd image store.
+# shellcheck disable=SC2029
 if ! ssh "${SSH_ARGS[@]}" "$REMOTE_SUDO docker info -f '{{ .DriverStatus }}' | grep -q 'containerd.snapshotter'"; then
     info "Remote Docker doesn't use containerd image store. Pulling image from unregistry..."
 
@@ -396,6 +401,7 @@ if ! ssh "${SSH_ARGS[@]}" "$REMOTE_SUDO docker info -f '{{ .DriverStatus }}' | g
 fi
 
 info "Removing unregistry container on remote host..."
+# shellcheck disable=SC2029
 ssh "${SSH_ARGS[@]}" "$REMOTE_SUDO docker rm -f $UNREGISTRY_CONTAINER" >/dev/null || true
 
 success "Successfully pushed '$IMAGE' to $SSH_ADDRESS"