From ce2cef4fef38f83c19bf637f5cae83c10434992e Mon Sep 17 00:00:00 2001
From: "tbhb.dev Agent" <334376894+tbhb-agent@users.noreply.github.com>
Date: Mon, 2 Nov 2026 09:03:47 -0500
Subject: [PATCH] feat(shell): report migration burn-down on main

The remaining shell needs a visible migration count without blocking
changes while commands move to Go. Report each script and the total in
an informational job on default branch pushes.

Assisted-by: codex:gpt-6.1-sol
Signed-off-by: Tony Burns <tony@tonyburns.net>
---
 .github/workflows/shell-burn-down.yml | 38 ++++++++++++++++++++++++++
 cmd/shell-allowlist/workflow_test.go  | 39 +++++++++++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 .github/workflows/shell-burn-down.yml
 create mode 100644 cmd/shell-allowlist/workflow_test.go

diff --git a/.github/workflows/shell-burn-down.yml b/.github/workflows/shell-burn-down.yml
new file mode 100644
index 00000000..e346ca1e
--- /dev/null
+++ b/.github/workflows/shell-burn-down.yml
@@ -0,0 +1,38 @@
+---
+name: shell-burn-down
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  shell-burn-down:
+    name: Shell burn-down
+    runs-on: ubuntu-24.04
+    continue-on-error: true
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up mise
+        uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3
+        with:
+          # renovate: datasource=github-releases depName=jdx/mise
+          version: 2026.10.19
+          install_args: go
+
+      - name: Summarize all shell scripts
+        env:
+          MISE_LOCKED: "1"
+          MISE_TASK_RUN_AUTO_INSTALL: "0"
+        run: go run ./cmd/shell-allowlist --summary >> "$GITHUB_STEP_SUMMARY"
diff --git a/cmd/shell-allowlist/workflow_test.go b/cmd/shell-allowlist/workflow_test.go
new file mode 100644
index 00000000..75ca7a4d
--- /dev/null
+++ b/cmd/shell-allowlist/workflow_test.go
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Tony Burns
+
+package main
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v3"
+)
+
+func TestBurnDownWorkflow(t *testing.T) {
+	t.Parallel()
+	data, err := os.ReadFile("../../.github/workflows/shell-burn-down.yml")
+	require.NoError(t, err)
+	var workflow struct {
+		On struct {
+			Push struct {
+				Branches []string `yaml:"branches"`
+			} `yaml:"push"`
+		} `yaml:"on"`
+		Jobs map[string]struct {
+			ContinueOnError bool `yaml:"continue-on-error"`
+			Steps           []struct {
+				Run string `yaml:"run"`
+			} `yaml:"steps"`
+		} `yaml:"jobs"`
+	}
+	require.NoError(t, yaml.Unmarshal(data, &workflow))
+	assert.Equal(t, []string{"main"}, workflow.On.Push.Branches)
+	require.Len(t, workflow.Jobs, 1)
+	job := workflow.Jobs["shell-burn-down"]
+	assert.True(t, job.ContinueOnError)
+	require.NotEmpty(t, job.Steps)
+	assert.Equal(t, `go run ./cmd/shell-allowlist --summary >> "$GITHUB_STEP_SUMMARY"`, job.Steps[len(job.Steps)-1].Run)
+}