Add Codex repository guidance and validation

scripts/check-bash.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -o errexit
+set -o nounset
+set -o pipefail
+
+STRICT="${STRICT:-0}"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+ok_count=0
+warn_count=0
+fail_count=0
+
+ok() {
+  printf 'OK: %s\n' "$*"
+  ok_count=$((ok_count + 1))
+}
+
+warning() {
+  printf 'WARNING: %s\n' "$*"
+  warn_count=$((warn_count + 1))
+}
+
+critical() {
+  printf 'CRITICAL: %s\n' "$*"
+  fail_count=$((fail_count + 1))
+}
+
+mapfile -t bash_files < <(find "$ROOT_DIR" -path "$ROOT_DIR/.git" -prune -o -type f -name '*.sh' -print | sort)
+
+if ((${#bash_files[@]} == 0)); then
+  warning "No Bash scripts found"
+else
+  for file in "${bash_files[@]}"; do
+    if bash -n "$file"; then
+      ok "bash -n ${file#"$ROOT_DIR"/}"
+    else
+      critical "bash syntax failed: ${file#"$ROOT_DIR"/}"
+    fi
+
+    first_line="$(sed -n '1p' "$file")"
+    if [[ "$first_line" != '#!/usr/bin/env bash' ]]; then
+      warning "Non-standard shebang in ${file#"$ROOT_DIR"/}"
+    fi
+
+    if ! grep -Eq 'set -o errexit|set -euo pipefail|set -eu|set -e' "$file"; then
+      warning "No errexit-style strict mode detected in ${file#"$ROOT_DIR"/}"
+    fi
+  done
+fi
+
+if command -v shellcheck >/dev/null 2>&1; then
+  if shellcheck -x \
+    -e SC1091 \
+    -P "$ROOT_DIR/infra-run/scripts/bash/disk-full" \
+    -P "$ROOT_DIR/infra-run/scripts/bash/gpfs" \
+    -P "$ROOT_DIR/infra-run/scripts/bash/veritas" \
+    "${bash_files[@]}"; then
+    ok "shellcheck"
+  else
+    critical "shellcheck reported issues"
+  fi
+else
+  if [[ "$STRICT" == "1" ]]; then
+    critical "shellcheck not installed"
+  else
+    warning "shellcheck not installed; skipped optional lint"
+  fi
+fi
+
+printf '\nBash summary: %d OK, %d WARNING, %d CRITICAL\n' "$ok_count" "$warn_count" "$fail_count"
+
+if ((fail_count > 0)); then
+  exit 1
+fi
+
+exit 0