Fix Shellcheck violations

[Potherca]

This MR fixes a lot of the violations mentioned in #78 and adds a GitHub Action to prevent regression.

All of the following files are now clean:

• lib/getdeps/getdeps.sh
• lib/list/list.sh
• lib/package/package.sh
• lib/show/show.sh
• lib/term/term.sh
• lib/update/update.sh
• lib/utils/utils.sh

The output of the GitHub Action can be seen here: https://github.com/potherca-contrib/bpkg/actions/runs/475635343

[szepeviktor]

You can use checkstyle output format and convert it to GitHub annotations.
https://github.com/staabm/annotate-pull-request-from-checkstyle

[szepeviktor]

No!
Look at this: https://github.com/marketplace/actions/shellcheck

[Potherca]

@szepeviktor I'd rather use actions/pipeline-components-shellcheck than actions/shellcheck, as action-shellcheck does work in the host, where the pipeline-component is a self-contained docker image.

Because of this, the action is guaranteed to have fewer issues when run locally (using act). It also makes it possible to use the same image on other systems (either other CI or locally, if act is not present/desirable).

staabm/annotate-pull-request-from-checkstyle looks overly complex, considering that all you need are a problem matcher json and an echo ::add-matcher:: call (as demonstrated in https://github.com/potherca-contrib/bpkg/pull/2/files)

We're in the process of adding problem matchers for GHA to all the Pipeline-Components, so only one action would be needed for both running shellcheck and annotating the MR.

[Potherca]

@jwerle I'm inclined to merge this to develop rather than master so it can be beta-tested before being released. (Since people seem to be pulling from master rather than using provided versions...).

[jwerle]

Good idea. Yeah, that sounds good