feat: new secscan action

.github/shellcheck-actions.sh

@@ -14,5 +14,9 @@ SHELLCHECK_OPTS=(
 
 for f in "$DIR"/../**/*.yaml; do
     info "Linting scripts in $f"
-    yq '.runs.steps[].run' "$f" | grep -v -P "^null$" | shellcheck "${SHELLCHECK_OPTS[@]}" -
+    # Filter out scripts that don't have any shell scripts in them
+    scripts=$(yq '.runs.steps[].run' "$f" | (grep -v -P "^null$" || true))
+    if [[ -n "$scripts" ]]; then
+        echo "$scripts" | shellcheck "${SHELLCHECK_OPTS[@]}" -
+    fi
 done

.gitignore

@@ -10,7 +10,6 @@ __pycache__/
 .Python
 build/
 develop-eggs/
-dist/
 downloads/
 eggs/
 .eggs/
@@ -165,3 +164,6 @@ docs/.sphinx/.wordlist.dic
 
 # output of contributors script
 contributors.html
+
+# PNPM
+node_modules/

build.mjs

@@ -0,0 +1,20 @@
+import * as esbuild from "esbuild";
+
+const [entryPoint, outfile] = process.argv.slice(2);
+
+if (!entryPoint || !outfile) {
+  console.error("Usage: node build.mjs <entryPoint> <outfile>");
+  process.exit(1);
+}
+
+await esbuild.build({
+  entryPoints: [entryPoint],
+  bundle: true,
+  platform: "node",
+  target: "node24",
+  format: "esm",
+  outfile,
+  banner: {
+    js: "import { createRequire as __require__ } from 'module'; globalThis.require = __require__(import.meta.url);",
+  },
+});

eslint.config.js

@@ -0,0 +1,20 @@
+// @ts-check
+import js from "@eslint/js";
+import { defineConfig } from "eslint/config";
+import tseslint from "typescript-eslint";
+
+export default defineConfig([
+  {
+    ignores: ["**/dist/**", "**/node_modules/**", "docs/**"],
+  },
+  {
+    files: ["**/*.ts"],
+    extends: [js.configs.recommended, tseslint.configs.recommended],
+    languageOptions: {
+      parserOptions: {
+        projectService: true,
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+  },
+]);

package.json

@@ -0,0 +1,31 @@
+{
+  "name": "starflow",
+  "version": "0.0.1",
+  "description": "A set of GitHub Actions used by the craft tools and libraries.",
+  "private": true,
+  "scripts": {
+    "build": "pnpm -r run build",
+    "test": "pnpm -r run test",
+    "lint": "eslint . && tsc --noEmit"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "GPL-3.0-only",
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": "^11.7.0",
+      "onFail": "warn"
+    }
+  },
+  "type": "module",
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.9.3",
+    "esbuild": "^0.28.1",
+    "eslint": "^10.5.0",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.61.1",
+    "vitest": "^4.1.9"
+  }
+}