fix(scripts): pass shellcheck targets via git blob to avoid argv limit

Per kriskowal review on PR #401, stream the
.sh file list through a git blob (`git hash-object -w --stdin` then
`git cat-file blob $HASH`) instead of stuffing the list into a shell
variable. This keeps us clear of ARG_MAX limits on hosts with many
tracked .sh files.

Author: endolinbot

scripts/shellcheck.sh

@@ -14,20 +14,21 @@
 
 set -eu
 
-# Read NUL-delimited paths into a single newline-separated list so the body
-# can branch on emptiness. xargs is not used directly because BSD xargs
-# (macOS) lacks `-r` and runs the command on an empty list, which would
-# invoke `shellcheck` with no positional arguments and read from stdin.
-files=$(git ls-files -z '*.sh' | tr '\0' '\n')
+# Stash the file list as a git blob and stream it back out, rather than
+# holding it in a shell variable. This keeps us clear of ARG_MAX limits
+# on hosts with a large number of tracked .sh files, and lets the body
+# branch on emptiness without an oversize positional-argument list.
+HASH=$(git ls-files -z '*.sh' | tr '\0' '\n' | git hash-object -w --stdin)
 
-if [ -z "$files" ]; then
+if [ -z "$(git cat-file blob "$HASH")" ]; then
   echo "shellcheck: no .sh files tracked; skipping."
   exit 0
 fi
 
 # shellcheck disable=SC2086
-# Word splitting on $files is intentional: each line is a separate path
-# and tracked .sh filenames in this repo do not contain whitespace.
-# `git ls-files` would happily emit NULs for whitespace-bearing names; if
-# such a name lands here, switch to xargs -0 with a portability shim.
-echo "$files" | xargs shellcheck -S warning "$@"
+# Word splitting on the blob's contents is intentional: each line is a
+# separate path and tracked .sh filenames in this repo do not contain
+# whitespace. `git ls-files` would happily emit NULs for whitespace-bearing
+# names; if such a name lands here, switch to xargs -0 with a portability
+# shim.
+git cat-file blob "$HASH" | xargs shellcheck -S warning "$@"