[security] add prose explaining OpenSSF CII Best Practices badge results #1109

	name: 'Tests: shellcheck'

	on: [pull_request, push]

	jobs:
	shellcheck_matrix:
	permissions:
	contents: read
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	shell:
	- bash
	- sh
	- dash
	- ksh
	file:
	- nvm.sh
	include:
	- shell: bash
	file: install.sh # only supported on bash
	- shell: bash
	file: bash_completion # only needed in bash/zsh
	- shell: bash
	file: nvm-exec # only runs in bash

	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@v1
	with:
	allowed-endpoints:
	ghcr.io:443
	github.com:443
	pkg-containers.githubusercontent.com:443
	- uses: actions/checkout@v3
	- name: Set up Homebrew
	uses: Homebrew/actions/setup-homebrew@master
	- name: Install latest shellcheck
	run: brew install shellcheck
	env:
	HOMEBREW_NO_ANALYTICS: 1
	- run: which shellcheck
	- run: shellcheck --version
	- name: Run shellcheck on ${{ matrix.file }}
	run: shellcheck -s ${{ matrix.shell }} ${{ matrix.file }}

	shellcheck:
	permissions:
	contents: none
	needs: [shellcheck_matrix]
	runs-on: ubuntu-latest
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@v1
	with:
	egress-policy: block
	- run: 'echo tests completed'

Provide feedback