chore(gate): shellcheck joins the gate — every tracked shell script, the host binary held to a pin

2026-10-17 15:31:34 +02:00
parent 0a1fef28ac
commit 66181d1394
4 changed files with 37 additions and 3 deletions
@@ -12,7 +12,7 @@ router-free navigation provider.

 ## The gate — never merge or ship red

-The local gate is **ruff (`check` + `format --check`) + basedpyright (backend) + the lock check + typecheck (3 tsc projects) +
+The local gate is **ruff (`check` + `format --check`) + shellcheck + basedpyright (backend) + the lock check + typecheck (3 tsc projects) +
 eslint + prettier --check + knip + vitest + vite build + pytest + pip-audit + npm audit**. It runs
 before every `release` merges and on every `publish`, which **refuses to build on failure — there is deliberately no `--skip`
 flag**; a release also requires the Playwright suite, and the image must pass a Trivy scan before it is pushed. Run it and get it