From 28685a30ea69dec569777a1f4768c424618a536b Mon Sep 17 00:00:00 2001
From: wolfgang1211 <96655145+wolfgang1211@users.noreply.github.com>
Date: Sun, 9 Aug 2026 20:40:30 +0300
Subject: [PATCH 1/2] ci: run arcup installer shell tests and shellcheck

arcup/test_arcup.sh has 25 assertions covering release-target mapping,
SHA-256 checksum verification, GitHub token/gh/curl download fallbacks,
tar path-traversal rejection, and symlink rejection during install. No
workflow or Make target ran it, so the installer every node operator
pipes into bash had no CI coverage and regressions could land silently.

Add a 'make test-arcup' target that discovers arcup/test_*.sh and
arcup/*_test.sh, wire it into test-all, and add a standalone 'Arcup
Installer' CI job that also runs shellcheck over arcup/arcup and
arcup/install. Both scripts are shellcheck-clean today, so the job
passes on main as-is.

The suite glob keeps future arcup test files covered without a further
CI change.
---
 .github/workflows/ci.yml | 16 ++++++++++++++++
 Makefile                 | 11 ++++++++++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b655f8fa..c98aed98 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -158,6 +158,22 @@ jobs:
           push: false
           archive: false
 
+  # ---------------------------------------------------------------------------
+  # arcup installer: shell lint + unit tests (standalone, no deps)
+  # ---------------------------------------------------------------------------
+
+  arcup:
+    name: Arcup Installer
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Run shellcheck
+        run: shellcheck arcup/arcup arcup/install
+
+      - name: Run arcup shell tests
+        run: make test-arcup
+
   # ---------------------------------------------------------------------------
   # Solidity Contracts: lint (fast) -> build -> test
   # ---------------------------------------------------------------------------
diff --git a/Makefile b/Makefile
index f7c48922..ec0ffd9a 100644
--- a/Makefile
+++ b/Makefile
@@ -136,8 +136,17 @@ test-it: up ## Run integration tests
 	cargo install cargo-nextest --locked
 	cargo nextest run $(UNIT_TEST_ARGS) --features integration
 
+.PHONY: test-arcup
+test-arcup: ## Run arcup installer shell tests
+	@echo running arcup installer tests...
+	@for suite in arcup/test_*.sh arcup/*_test.sh; do \
+		[ -f "$$suite" ] || continue; \
+		echo "--- $$suite"; \
+		bash "$$suite" || exit 1; \
+	done
+
 .PHONY: test-all
-test-all: test-it test-unit-contract ## Run all tests
+test-all: test-it test-unit-contract test-arcup ## Run all tests
 	@echo running all tests...
 	make smoke LAUNCH_ARGS="--frozen --healthy-retry=130"
 

From 5aa36a5a8992e9626909633afd5d20fda042a634 Mon Sep 17 00:00:00 2001
From: wolfgang1211 <96655145+wolfgang1211@users.noreply.github.com>
Date: Sun, 9 Aug 2026 23:31:49 +0300
Subject: [PATCH 2/2] ci: install shellcheck explicitly in the arcup job
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The job relied on ubuntu-latest shipping shellcheck, which made it the
one place in ci.yml leaning on the runner image for a tool it depends
on — every other job provisions its own (libclang/zlib via apt for the
Rust jobs, setup-node, foundry-toolchain, buf-action).

Install it via apt using the same phrasing those jobs use, so the lint
gate is pinned to the distro package rather than to whatever the image
happens to bundle.
---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c98aed98..25f480e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -168,6 +168,9 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends shellcheck
+
       - name: Run shellcheck
         run: shellcheck arcup/arcup arcup/install