add shellcheck & shfmt to pre-commit's pre-push hook (#59485)

Closes https://github.com/sourcegraph/sourcegraph/issues/54829

Next steps: 
- what safeguards will we have in place for when we remove this from `sg lint`
- should we remove it from `sg lint`, its likely not contributing much overhead even in the uncommon case of shell files being touched

_How did some of these violations get in when theres shell lints :clueless:_

## Test plan

`pre-commit run --hook-stage=pre-push shellcheck shfmt`

.pre-commit-config.yaml

@@ -21,3 +21,23 @@ repos:
       'types': [text]
       args: []
       require_serial: false
+    - id: shellcheck
+      name: shellcheck
+      description: 'Run shellcheck'
+      entry: ./dev/check/shellcheck.sh
+      language: script
+      # TODO: adapt shellcheck.sh to only operate on passed-in files,
+      # and fallback to git ls-files when empty
+      pass_filenames: false
+      files: '.*\.(sh|bash)'
+      stages: [pre-push]
+    - id: shfmt
+      name: shfmt
+      description: 'Run shfmt'
+      entry: ./dev/check/shfmt.sh
+      language: script
+      # TODO: adapt shfmt.sh to only operate on passed-in files,
+      # and fallback to git ls-files when empty
+      pass_filenames: false
+      files: '.*\.(sh|bash)'
+      stages: [pre-push]

dev/ci/parallel_run.sh

@@ -26,4 +26,4 @@ cat "$log_file"
 
 create_annotation "$code" "$log_file"
 
-exit $code
+exit "$code"

dev/ci/scripts/wolfi/build-package.sh

@@ -5,6 +5,8 @@ set -euf -o pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")/../../../.."
 
 tmpdir=$(mktemp -d -t melange-bin.XXXXXXXX)
+# shellcheck disable=SC2317
+# false positive by shellcheck https://github.com/koalaman/shellcheck/issues/2660
 function cleanup() {
   echo "Removing $tmpdir"
   rm -rf "$tmpdir"

dev/ci/trivy/trivy-scan-high-critical.sh

@@ -83,6 +83,6 @@ case "${exitCode:-"0"}" in
     ;;
   *)
     # some other kind of error occurred
-    exit $exitCode
+    exit "$exitCode"
     ;;
 esac

dev/comby-install-or-upgrade.sh

@@ -68,7 +68,7 @@ fi
 
 chmod 755 "$TMP/$RELEASE_BIN"
 echo "[+] Installing comby to $INSTALL_DIR"
-if [ ! $OS == "macos" ]; then
+if [ ! "$OS" == "macos" ]; then
   printf "[*] To install comby to %s requires sudo access. Please type the sudo password in the prompt below.\n" "$INSTALL_DIR"
   sudo cp "$TMP/$RELEASE_BIN" "$INSTALL_DIR/comby"
 else
@@ -87,7 +87,7 @@ CHECK=$(printf 'printf("hello world!\\\n");' | "$INSTALL_DIR"/comby 'printf("hel
 if [ "$CHECK" == "broken" ]; then
   printf "[-] comby did not install correctly.\n"
   printf "[-] My guess is that you need to install the pcre library on your system. Try:\n"
-  if [ $OS == "macos" ]; then
+  if [ "$OS" == "macos" ]; then
     printf "[*] brew install comby\n"
   else
     printf "[*] sudo apt-get install libpcre3-dev && bash <(curl -sL get-comby.netlify.app)\n"

dev/licenses.sh

@@ -41,4 +41,4 @@ license_finder dependencies list
 
 # run license check
 echo "Running license_finder - if this fails, refer to our handbook: https://docs.sourcegraph.com/dev/background-information/ci#third-party-licenses"
-license_finder ${COMMAND} --columns=package_manager name version licenses homepage approved
+license_finder "${COMMAND}" --columns=package_manager name version licenses homepage approved

dev/phabricator/start.sh

@@ -53,7 +53,7 @@ docker run -d --name $app_container -p 80:80 -p 443:443 \
   -e PHABRICATOR_PASSWORD=sourcegraph \
   -e PHABRICATOR_EMAIL=phabricator@sourcegraph.com \
   -e MARIADB_HOST=$db_container \
-  bitnami/phabricator:${version}
+  bitnami/phabricator:"${version}"
 
 echo
 echo "Phabricator ${version} is now running at http://127.0.0.1"