ci: run shellcheck and hadolint via lint script

Author: mgarratt

.github/workflows/pr.yml

@@ -4,8 +4,21 @@ on:
   pull_request:
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: jdx/mise-action@v2
+        with:
+          cache: true
+
+      - name: Lint
+        run: ./scripts/lint.sh
+
   matrix:
     runs-on: ubuntu-latest
+    needs: [lint]
     outputs:
       matrix: ${{ steps.gen.outputs.matrix }}
       count: ${{ steps.gen.outputs.count }}
@@ -63,4 +76,3 @@ jobs:
           tags: local/${{ matrix.image_name }}:pr-${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-

.github/workflows/publish.yml

@@ -10,8 +10,21 @@ permissions:
   packages: write
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: jdx/mise-action@v2
+        with:
+          cache: true
+
+      - name: Lint
+        run: ./scripts/lint.sh
+
   matrix:
     runs-on: ubuntu-latest
+    needs: [lint]
     outputs:
       matrix: ${{ steps.gen.outputs.matrix }}
       count: ${{ steps.gen.outputs.count }}
@@ -93,4 +106,3 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-

AGENTS.md

@@ -51,10 +51,15 @@ Notes:
 - Use `mise` to install tool dependencies in CI (via `jdx/mise-action`).
 - Builds must be multi-arch with Buildx (at least `linux/amd64` and `linux/arm64`).
 - PRs should validate Dockerfiles (lint + build) but must not push to GHCR.
+- CI must run repo linting via `./scripts/lint.sh` (ShellCheck for `scripts/*.sh`, Hadolint for `images/*/Dockerfile`).
+
+## Linting
+
+- Run locally: `./scripts/lint.sh`
+- CI must run this script on PRs and on `main` publishes so linting stays consistent across sessions.
 
 ## Adding A New Image
 
 1. Create `images/<image>/Dockerfile` and `.dockerignore`.
 2. Add `images/<image>/image.toml` (set `version` if you want a stable tag).
 3. Add a short `images/<image>/README.md`.
-

scripts/lint.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+echo "[lint] shellcheck"
+if command -v shellcheck >/dev/null 2>&1; then
+  shellcheck scripts/*.sh
+elif command -v mise >/dev/null 2>&1; then
+  mise exec -- shellcheck scripts/*.sh
+else
+  echo "[lint] shellcheck (missing; install via mise)" >&2
+  exit 127
+fi
+
+dockerfiles=()
+while IFS= read -r -d '' f; do
+  dockerfiles+=("$f")
+done < <(find images -mindepth 2 -maxdepth 2 -type f -name Dockerfile -print0 2>/dev/null || true)
+
+if [[ ${#dockerfiles[@]} -gt 0 ]]; then
+  echo "[lint] hadolint"
+  for f in "${dockerfiles[@]}"; do
+    if command -v hadolint >/dev/null 2>&1; then
+      hadolint "$f"
+    elif command -v mise >/dev/null 2>&1; then
+      mise exec -- hadolint "$f"
+    else
+      echo "[lint] hadolint (missing; install via mise)" >&2
+      exit 127
+    fi
+  done
+else
+  echo "[lint] hadolint (skipped; no Dockerfiles found)"
+fi