koalaman/shellcheck:stable is built FROM scratch with shellcheck as the
entrypoint and no /bin/sh, so the runner cannot start a job script in it
and the job fails with an OCI runtime error before shellcheck ever runs.
The -alpine variant is the same tool with a shell around it.
Ports .github/workflows/ci.yml to .gitlab-ci.yml after the GitHub account
was suspended and Actions stopped being reachable. Same checks, same order.
The Actions workflow stays in the tree: it is the reference this was
written from and it works unchanged if the appeal succeeds. The image is
pinned by digest rather than tag, which is the replacement for the
workflow's SHA-pinned actions -- GitLab has no action allowlist to lean on.
jcoffey-dev