ci: add differential ShellCheck

This should only report errors on lines that are changed in a PR, and not block merges for pre-existing bugs.

Signed-off-by: Edwin Török <[email protected]>

.github/workflows/main.yml

@@ -12,6 +12,28 @@ concurrency:  # On new push, cancel old workflows from the same PR, branch or ta
   cancel-in-progress: true
 
 jobs:
+  # https://www.shellcheck.net/wiki/GitHub-Actions
+  # https://github.com/redhat-plumbers-in-action/differential-shellcheck?tab=readme-ov-file#usage
+  shell-test:
+    name: Differential ShellCheck
+    runs-on: ubuntu-latest
+
+    permissions:
+      security-events: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+            fetch-depth: 0
+
+# If needed severity levels can be controlled here
+#            severity: warning
+      - name: Differential ShellCheck
+        uses: redhat-plumbers-in-action/differential-shellcheck@v5
+        with:
+            token: ${{ secrets.GITHUB_TOKEN }}
+
   python-test:
     name: Python tests
     runs-on: ubuntu-22.04