From 0f17cd6622ccc4a8affa79a218095f402644756b Mon Sep 17 00:00:00 2001
From: John Coffey <johnellis@linux.com>
Date: Sun, 20 Sep 2026 20:11:33 -0700
Subject: [PATCH 1/2] Run CI on the self-hosted GitLab

Ports .github/workflows/ci.yml to .gitlab-ci.yml after the GitHub account
was suspended and Actions stopped being reachable. Same checks, same order.

The Actions workflow stays in the tree: it is the reference this was
written from and it works unchanged if the appeal succeeds. The image is
pinned by digest rather than tag, which is the replacement for the
workflow's SHA-pinned actions -- GitLab has no action allowlist to lean on.
---
 .gitlab-ci.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .gitlab-ci.yml

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..7e80cb2
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,26 @@
+# CI on the self-hosted GitLab, ported from .github/workflows/shellcheck.yml
+# when the GitHub account was suspended on 2026-09-20. The Actions file stays
+# in the tree as the reference.
+#
+# ludeeus/action-shellcheck has no GitLab equivalent, so this runs shellcheck
+# directly from its own digest-pinned image and reproduces the settings the
+# action was given: severity=warning, gcc format, every script in one run.
+
+stages: [lint]
+
+shellcheck:
+  stage: lint
+  image:
+    name: koalaman/shellcheck:stable@sha256:bb596a0d169b85ddd81d8b6d3a2ff6d5baf5fca10b97f575ebc647c3dff62b3d # stable
+    # The image's entrypoint is shellcheck itself, which would swallow the
+    # runner's shell; GitLab needs a shell to drive the job.
+    entrypoint: [""]
+  script:
+    - |
+      files=$(find . -name '*.sh' -not -path './.git/*' | sort)
+      [ -n "$files" ] || { echo "no shell scripts found"; exit 1; }
+      echo "$files" | tr '\n' ' '
+      shellcheck --severity=warning --format=gcc $files
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-- 
2.54.0


From 45be9ca79fdd5a1d4bcdc075a5624a67fcf049cb Mon Sep 17 00:00:00 2001
From: John Coffey <johnellis@linux.com>
Date: Sun, 20 Sep 2026 20:21:17 -0700
Subject: [PATCH 2/2] Use the shellcheck image that has a shell in it

koalaman/shellcheck:stable is built FROM scratch with shellcheck as the
entrypoint and no /bin/sh, so the runner cannot start a job script in it
and the job fails with an OCI runtime error before shellcheck ever runs.
The -alpine variant is the same tool with a shell around it.
---
 .gitlab-ci.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7e80cb2..2db6165 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -10,11 +10,12 @@ stages: [lint]
 
 shellcheck:
   stage: lint
-  image:
-    name: koalaman/shellcheck:stable@sha256:bb596a0d169b85ddd81d8b6d3a2ff6d5baf5fca10b97f575ebc647c3dff62b3d # stable
-    # The image's entrypoint is shellcheck itself, which would swallow the
-    # runner's shell; GitLab needs a shell to drive the job.
-    entrypoint: [""]
+  # The -alpine variant, not koalaman/shellcheck:stable. That one is built
+  # FROM scratch with shellcheck as the entrypoint and no shell at all, so the
+  # runner cannot start a job script in it and the job dies before it runs
+  # ("OCI runtime create failed"). Clearing the entrypoint does not help: there
+  # is still no /bin/sh to clear it to.
+  image: koalaman/shellcheck-alpine:stable@sha256:c82fe42504fbc9fc68f15d36638e5ee2324ebb8b94e96a3c4e395bf361c49183 # stable
   script:
     - |
       files=$(find . -name '*.sh' -not -path './.git/*' | sort)
-- 
2.54.0