The chart ships shell scripts into the init containers, where a quoting or exit code bug surfaces as a broken deployment rather than as a failing test. The bats suite covers the behaviour of config_environment.sh, but not the classes of defects a static analyser catches, so shellcheck runs alongside it now. The action is pinned to a commit sha, as the other actions of this workflow already are. Note that the tag is named `2.0.0` and not `v2.0.0`, so the version comment deviates from the usual `# v<version>` form. Submodules are deliberately not checked out. The action scans the whole working directory, and bats-core alone would contribute several hundred files that are not ours to fix. Co-authored-by: Copilot <copilot@github.com>