From 0928dfdd1335f9688fe6ceafeb60c81717f943a2 Mon Sep 17 00:00:00 2001
From: Krzysztof kuhy Rudnicki <krzysztofrudnicki0@gmail.com>
Date: Fri, 28 Aug 2026 18:31:11 +0200
Subject: [PATCH] CI: pin shellcheck, and enable Actions on the repo

Two things kept CI from being green, and neither was the code.

First, GitHub Actions was DISABLED at the repository level. The workflows
registered fine and simply never ran -- `gh api .../actions/permissions`
returned {"enabled": false}. Now enabled.

Second, once it ran, shellcheck failed on a file that is clean locally:
SC2236 in PSD/zin3/python/run_temperature_system.sh. `language: system` hooks
use whatever is on PATH, and Ubuntu's packaged shellcheck is not the 0.11.0
this machine has, so the build went red for a difference in tool version
rather than in the code. That is the failure mode testsAndMisc pins tools to
avoid, so the workflow now installs shellcheck v0.11.0 and verifies its
SHA256 -- checked here first: the digest matches and the archive really does
unpack to shellcheck-v0.11.0/shellcheck.

The `! -z` -> `-n` fix is applied too. Pinning stops the next version drift;
fixing the code means this instance is right under either version.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
---
 .github/workflows/pre-commit.yml              | 19 +++++++++++++++++--
 .../PSD/zin3/python/run_temperature_system.sh |  6 +++---
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 5bb2345a..39fbe723 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -33,8 +33,23 @@ jobs:
         with:
           python-version: "3.x"
 
-      - name: Install shellcheck
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
+      # Pinned, not apt-installed. `language: system` hooks run whatever is on
+      # PATH, so an unpinned shellcheck makes CI disagree with every developer
+      # machine: Ubuntu's package flagged SC2236 in a file that 0.11.0 locally
+      # does not, and the build went red for a difference in tool version
+      # rather than in the code.
+      - name: Install shellcheck (pinned)
+        env:
+          SHELLCHECK_VERSION: v0.11.0
+          SHELLCHECK_SHA256: 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
+        run: |
+          set -euo pipefail
+          url="https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
+          curl -fsSL "$url" -o /tmp/sc.tar.xz
+          echo "${SHELLCHECK_SHA256}  /tmp/sc.tar.xz" | sha256sum -c -
+          tar -xJf /tmp/sc.tar.xz -C /tmp
+          sudo install -m 0755 "/tmp/shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/local/bin/shellcheck
+          shellcheck --version
 
       - uses: actions/cache@v4
         with:
diff --git a/Programming/PSD/zin3/python/run_temperature_system.sh b/Programming/PSD/zin3/python/run_temperature_system.sh
index db8315fc..a784cc36 100755
--- a/Programming/PSD/zin3/python/run_temperature_system.sh
+++ b/Programming/PSD/zin3/python/run_temperature_system.sh
@@ -31,17 +31,17 @@ cleanup() {
     echo -e "${YELLOW}Shutting down the temperature monitoring system...${NC}"
     
     # Kill all background processes
-    if [[ ! -z $GENERATOR_PID ]]; then
+    if [[ -n "${GENERATOR_PID}" ]]; then
         echo "Stopping temperature generator..."
         kill $GENERATOR_PID 2>/dev/null || true
     fi
     
-    if [[ ! -z $DETECTOR_PID ]]; then
+    if [[ -n "${DETECTOR_PID}" ]]; then
         echo "Stopping anomaly detector..."
         kill $DETECTOR_PID 2>/dev/null || true
     fi
     
-    if [[ ! -z $VISUALIZER_PID ]]; then
+    if [[ -n "${VISUALIZER_PID}" ]]; then
         echo "Stopping alarm visualizer..."
         kill $VISUALIZER_PID 2>/dev/null || true
     fi