platform-ci/source_tools/scripts/source-checks.sh

#!/usr/bin/env bash
# Optional legacy source checks (source-verify checks=...): the old orb CI commands, run with job-local tools. INPUT_CHECKS is a
# comma list of closed names; anything else fails. Tools go into a temp dir on PATH (no root, no apt, nothing global).
#   make-bats           old Munitor test job: make test-scripts test-templates, then bats tests (needs yq, bats, envsubst, shellcheck, make)
#   shellcheck-orb      circleci/shellcheck@3.2 check defaults (v3.2.0 source): every ./*.sh outside ./.git, --severity=style --format=tty, any output fails
# env: INPUT_CHECKS, INSTALL_TOOL (tests replace the pinned install)
set -eu
here=$(cd "$(dirname "$0")" && pwd)
install_tool=${INSTALL_TOOL:-$here/install-tool.sh}
checks=${INPUT_CHECKS:-}
[ -n "$checks" ] || exit 0
IFS=, read -r -a wanted <<<"$checks"
need_shellcheck=false; need_bats=false
for c in "${wanted[@]}"; do
  case "$c" in
    make-bats) need_bats=true; need_shellcheck=true ;;
    shellcheck-orb) need_shellcheck=true ;;
    *) echo "source-checks: unknown check '$c'" >&2; exit 1 ;;
  esac
done
tools=$(mktemp -d)
trap 'rm -rf "$tools"' EXIT
if [ "$need_shellcheck" = true ]; then
  bash "$install_tool" shellcheck "$tools/shellcheck"
  PATH="$tools/shellcheck:$PATH"
fi
if [ "$need_bats" = true ]; then
  bash "$install_tool" yq "$tools/yq"
  bash "$install_tool" jq "$tools/jq"
  bash "$install_tool" bats "$tools/bats"
  bash "$install_tool" envsubst "$tools/envsubst"
  PATH="$tools/yq:$tools/jq:$tools/bats/bin:$tools/envsubst:$PATH"
fi
export PATH
for c in "${wanted[@]}"; do
  case "$c" in
    make-bats)
      make test-scripts test-templates
      bats tests ;;
    shellcheck-orb)
      log="$tools/shellcheck.log"; : > "$log"; failed=0
      while IFS= read -r -d '' script; do
        if ! shellcheck --severity=style --format=tty "$script" >> "$log"; then failed=1; fi
      done < <(find . -name '*.sh' -type f ! -path './.git/*' -print0)
      if [ "$failed" = 1 ] || [ -s "$log" ]; then cat "$log"; echo "source-checks: ShellCheck errors found" >&2; exit 1; fi ;;
  esac
done