ci: add Bash parse-only syntax gate for tracked scripts/*.sh (#115)

Adds scripts/check-scripts.mjs to the root check gate (npm run
verify), running `bash -n` over every git-tracked scripts/*.sh file
so a malformed script fails CI before merge.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: bketelsen

package.json

@@ -8,9 +8,10 @@
   },
   "scripts": {
     "check": "npm run verify",
-    "verify": "npm run check:docs && npm run check:organization && npm test",
+    "verify": "npm run check:docs && npm run check:organization && npm run check:scripts && npm test",
     "check:docs": "node scripts/check-docs.mjs",
     "check:organization": "node scripts/check-organization.mjs",
+    "check:scripts": "node scripts/check-scripts.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

scripts/check-scripts.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+// Shell-syntax gate: every tracked scripts/*.sh file parses as valid Bash
+// (ADR-0021 CI). Parse-only (`bash -n`) — it never executes a script.
+import { execFileSync } from "node:child_process";
+import { dirname, resolve } from "node:path";
+
+const root = resolve(dirname(new URL(import.meta.url).pathname), "..");
+
+const files = execFileSync("git", ["ls-files", "scripts/*.sh"], {
+  cwd: root,
+  encoding: "utf8",
+})
+  .split("\n")
+  .filter(Boolean);
+
+const failures = [];
+for (const file of files) {
+  try {
+    execFileSync("bash", ["-n", file], { cwd: root, stdio: "pipe" });
+  } catch (error) {
+    const message = String(error.stderr || error.message).trim().split("\n")[0];
+    failures.push(`syntax: ${file}: ${message}`);
+  }
+}
+
+for (const failure of failures) console.error(`FAIL ${failure}`);
+const ok = failures.length === 0;
+console.log(`${ok ? "ok  " : "FAIL"} bash_syntax: ${files.length - failures.length}/${files.length}`);
+process.exit(ok ? 0 : 1);

test/check-scripts.test.mjs

@@ -0,0 +1,62 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { copyFile, mkdir, mkdtemp, readdir, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+
+const execFileAsync = promisify(execFile);
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+test("bash syntax gate passes on the repository's current tracked scripts", async () => {
+  const root = await createFixture();
+  for (const name of await readdir(path.join(repoRoot, "scripts"))) {
+    if (name.endsWith(".sh")) {
+      await copyFile(
+        path.join(repoRoot, "scripts", name),
+        path.join(root, "scripts", name),
+      );
+    }
+  }
+  await track(root);
+
+  const { stdout } = await runScriptsGate(root);
+  assert.match(stdout, /ok {3}bash_syntax: 3\/3/);
+});
+
+test("bash syntax gate fails a tracked script with invalid Bash syntax", async () => {
+  const root = await createFixture();
+  await writeFile(
+    path.join(root, "scripts/broken.sh"),
+    "#!/usr/bin/env bash\nif [ -z \"$1\" ]; then\n  echo missing\n",
+  );
+  await track(root);
+
+  await assert.rejects(
+    runScriptsGate(root),
+    (error) => error.stderr.includes("FAIL syntax: scripts/broken.sh"),
+  );
+});
+
+async function createFixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), "core-scripts-gate-"));
+  await mkdir(path.join(root, "scripts"), { recursive: true });
+  await copyFile(
+    path.join(repoRoot, "scripts/check-scripts.mjs"),
+    path.join(root, "scripts/check-scripts.mjs"),
+  );
+  await execFileAsync("git", ["init", "--quiet"], { cwd: root });
+  return root;
+}
+
+async function track(root) {
+  await execFileAsync("git", ["add", "-A"], { cwd: root });
+}
+
+function runScriptsGate(root) {
+  return execFileAsync(process.execPath, [
+    path.join(root, "scripts/check-scripts.mjs"),
+  ], { cwd: root });
+}