From 0d1d8ac76998fe553a861e739d24a713af5b5d37 Mon Sep 17 00:00:00 2001
From: Daytona39264 <193613491+Daytona39264@users.noreply.github.com>
Date: Sun, 20 Sep 2026 21:48:52 -0400
Subject: [PATCH] ci: validate installer changes with syntax and ShellCheck
 checks

Run checks for installer and workflow changes, pin action revisions and ShellCheck, and limit the token to read-only contents access.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/lint-install.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/lint-install.yml

diff --git a/.github/workflows/lint-install.yml b/.github/workflows/lint-install.yml
new file mode 100644
index 00000000..ffe29953
--- /dev/null
+++ b/.github/workflows/lint-install.yml
@@ -0,0 +1,27 @@
+name: Lint install script
+
+on:
+  push:
+    paths:
+      - 'install.sh'
+      - '.github/workflows/lint-install.yml'
+  pull_request:
+    paths:
+      - 'install.sh'
+      - '.github/workflows/lint-install.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Check bash syntax
+        run: bash -n install.sh
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca
+        with:
+          scandir: '.'
+          version: v0.11.0