[Frawless]

Type of Change

• Task

Description

actionlint only checks run: steps in workflows, so the shell code in composite actions and in the .sh scripts was never linted. This adds .github/tests/shellcheck.sh (also runnable locally) and a shellcheck job in lint.yml.

• Checks all .sh files and every run: step of .github/actions/*/*/action.yml; ${{ }} expressions are replaced by a placeholder, like actionlint does.
• Fails on warning severity and above. Info-level findings (mostly unquoted variables, some of them intentional word splitting) are left for later.
• Fixes the 7 existing warnings (unused loop variables, unneeded sudo, unquoted command substitutions, a unicode quote, GPG_TTY handling in push-to-central.sh).

Checklist

• Update documentation
• Write tests
• Make sure all tests pass
• Try your changes inside a Kubernetes cluster, not just from unit tests
• AI assistance was used to create this PR (see the Strimzi AI policy)

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}