From 0f17cd6622ccc4a8affa79a218095f402644756b Mon Sep 17 00:00:00 2001
From: John Coffey <johnellis@linux.com>
Date: Sun, 20 Sep 2026 20:11:33 -0700
Subject: [PATCH] Run CI on the self-hosted GitLab

Ports .github/workflows/ci.yml to .gitlab-ci.yml after the GitHub account
was suspended and Actions stopped being reachable. Same checks, same order.

The Actions workflow stays in the tree: it is the reference this was
written from and it works unchanged if the appeal succeeds. The image is
pinned by digest rather than tag, which is the replacement for the
workflow's SHA-pinned actions -- GitLab has no action allowlist to lean on.
---
 .gitlab-ci.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .gitlab-ci.yml

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..7e80cb2
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,26 @@
+# CI on the self-hosted GitLab, ported from .github/workflows/shellcheck.yml
+# when the GitHub account was suspended on 2026-09-20. The Actions file stays
+# in the tree as the reference.
+#
+# ludeeus/action-shellcheck has no GitLab equivalent, so this runs shellcheck
+# directly from its own digest-pinned image and reproduces the settings the
+# action was given: severity=warning, gcc format, every script in one run.
+
+stages: [lint]
+
+shellcheck:
+  stage: lint
+  image:
+    name: koalaman/shellcheck:stable@sha256:bb596a0d169b85ddd81d8b6d3a2ff6d5baf5fca10b97f575ebc647c3dff62b3d # stable
+    # The image's entrypoint is shellcheck itself, which would swallow the
+    # runner's shell; GitLab needs a shell to drive the job.
+    entrypoint: [""]
+  script:
+    - |
+      files=$(find . -name '*.sh' -not -path './.git/*' | sort)
+      [ -n "$files" ] || { echo "no shell scripts found"; exit 1; }
+      echo "$files" | tr '\n' ' '
+      shellcheck --severity=warning --format=gcc $files
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH