oelint: Add oelint-adv lint tooling and CI gate

Add the declarative oelint-adv setup shared across the OEL layers:

 * .oelint.cfg pins the release (wrynose) and the only layer-wide
   suppression, oelint.var.bbclassextend, which never applies to a
   target-only layer,
 * oelint.constants.json declares the project distro/machine override
   tokens oelint cannot know when run standalone,
 * contrib/oelint/run-oelint.sh enumerates the recipes and runs the
   linter serially,
 * .github/workflows/oelint.yaml runs it on pull requests, merge groups
   and master pushes through the yocto-env.nix lint devshell.

The layer lints clean, with every remaining exception documented inline
as a '# nooelint: <rule.id>' comment, so the gate is blocking.

Author: otavio

.github/workflows/oelint.yaml

@@ -0,0 +1,25 @@
+name: OE Lint
+
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  oelint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ossystems/nix-actions@v1
+        with:
+          install-nix: true
+          flake-check: false
+          build-hosts: false
+          build-devshells: false
+          devshell: github:OSSystems/yocto-env.nix#lint
+          run: ./contrib/oelint/run-oelint.sh

.oelint.cfg

@@ -0,0 +1,6 @@
+# oelint-adv defaults, auto-loaded from the working directory. Every recipe
+# here is target-only, so oelint.var.bbclassextend never applies; all other
+# exceptions stay inline as '# nooelint: <rule.id>' comments.
+[oelint]
+release = wrynose
+suppress = oelint.var.bbclassextend

contrib/oelint/run-oelint.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Run oelint-adv over meta-shellhub. Requires oelint-adv on PATH.
+#
+# Configuration is declarative and lives at the layer root: .oelint.cfg
+# (--release plus the bbclassextend suppression) and oelint.constants.json
+# (the layer constant-DB additions). Both are auto-loaded, so this script only
+# enumerates the files to lint.
+set -eu
+
+unset CDPATH
+
+here=$(cd -- "$(dirname -- "$0")" && pwd)
+layer=$(cd -- "$here/../.." && pwd)
+cd -- "$layer"
+
+files=$(find . \
+    \( -name '*.bb' -o -name '*.bbappend' -o -name '*.bbclass' -o -name '*.inc' \) \
+    | sort)
+
+# Run serially: parallel workers race while loading the layer constants and
+# emit spurious "unknown variable/override" findings. Pass '--jobs N' to override.
+# shellcheck disable=SC2086
+exec oelint-adv --jobs 1 "$@" $files

oelint.constants.json

@@ -0,0 +1,11 @@
+{
+    "comment": "Layer constant DB, auto-loaded by oelint-adv from the layer root. Declares the OEL project distro/machine override tokens it cannot know about when run standalone.",
+    "replacements": {
+        "distros": [
+            "oel"
+        ],
+        "machines": [
+            "arm"
+        ]
+    }
+}