feat: add shfmt task

README.md

@@ -20,7 +20,7 @@ stages:
 include:
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: 'gitlab-scanners.yml'
 ```
@@ -34,7 +34,7 @@ stages:
 include:
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: 'golangci-lint.yml'
 ```
@@ -50,7 +50,7 @@ stages:
 include:
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: 'editorconfig-check.yml'
 ```
@@ -91,7 +91,7 @@ stages:
 include:
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: 'semantic-release.yml'
 ```
@@ -173,7 +173,7 @@ variables:
 include:
   # build binary release artifacts with goreleaser
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: goreleaser.yml
 ```
@@ -202,7 +202,7 @@ include:
   # and that ASDF is generally working
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/README.md#asdf-tool-versions
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: asdf-tool-versions.yml
 ```
@@ -235,7 +235,7 @@ include:
   # Runs tflint on all terraform module directories
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: tflint.yml
 ```
@@ -259,7 +259,7 @@ include:
   # Ensures that all terraform files are correctly formatted
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: terraform-format.yml
 ```
@@ -283,7 +283,7 @@ include:
   # Ensures that all terraform files are syntactically valid
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: terraform-validate.yml
 ```
@@ -318,7 +318,7 @@ include:
   # Upgrades dependencies on a schedule
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/README.md#renovate-bot
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: renovate-bot.yml
 ```
@@ -343,11 +343,10 @@ include:
   # Runs Go unit tests
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/README.md#go-unittests
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v1.11.0 # renovate:managed
+    ref: v1.12.0 # renovate:managed
     file: go-unittests.yml
 ```
-
 ### [`go-mod-tidy`](./go-mod-tidy.yml)
 Ensures that [`go mod tidy`](https://go.dev/ref/mod) is up-to-date and `go.mod` and `go.sum` are tidy.
@@ -372,3 +371,29 @@ include:
     ref: v1.12.0 # renovate:managed
     file: go-mod-tidy.yml
 ```
+
+
+### [`shfmt`](./shfmt.yml)
+
+Validates that shell-scripts use a canonical formatting.
+
+1. Ensure that the `GL_ASDF_SHFMT_VERSION` version for Go is configured.
+
+```yaml
+stages:
+  - validate
+
+# Not needed if .gitlab-ci-asdf-versions.yml is included...
+variables:
+  GL_ASDF_SHFMT_VERSION: ...
+
+include:
+  # Not required, but recommended
+  - local: .gitlab-ci-asdf-versions.yml
+
+  # Ensure that all shell-scripts are formatted according to a
+  # standard canonical format
+  - project: 'gitlab-com/gl-infra/common-ci-tasks'
+    ref: v1.13.0 # renovate:managed
+    file: shfmt.yml
+```

shfmt.yml

+shfmt:
+  stage: validate
+  needs: []
+  image:
+    name: golang:1.17 # Client project doesn't need Golang, so don't use ASDF vars here.
+    entrypoint: [""]
+  script:
+    - go install mvdan.cc/sh/v3/cmd/shfmt@v${GL_ASDF_SHFMT_VERSION}
+    # Find all *.sh files, and any executable script files
+    - (
+        find . -type f \( -perm -u=x -not -name "*.sh" \) -not -path "*/.*/*" -print0 | xargs -0 grep -rIzlE '^#![[:blank:]]*(/usr/bin/env sh|/usr/bin/env bash|/bin/sh|/bin/bash)';
+        find . -type f -name "*.sh" -not -path "*/.*/*"
+      ) | xargs shfmt -w -l -s  -i 2 -d
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH