feat(shell): report migration burn-down on main

.github/workflows/shell-burn-down.yml

@@ -0,0 +1,38 @@
+---
+name: shell-burn-down
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  shell-burn-down:
+    name: Shell burn-down
+    runs-on: ubuntu-24.04
+    continue-on-error: true
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up mise
+        uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3
+        with:
+          # renovate: datasource=github-releases depName=jdx/mise
+          version: 2026.10.19
+          install_args: go
+
+      - name: Summarize all shell scripts
+        env:
+          MISE_LOCKED: "1"
+          MISE_TASK_RUN_AUTO_INSTALL: "0"
+        run: go run ./cmd/shell-allowlist --summary >> "$GITHUB_STEP_SUMMARY"

cmd/shell-allowlist/workflow_test.go

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Tony Burns
+
+package main
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v3"
+)
+
+func TestBurnDownWorkflow(t *testing.T) {
+	t.Parallel()
+	data, err := os.ReadFile("../../.github/workflows/shell-burn-down.yml")
+	require.NoError(t, err)
+	var workflow struct {
+		On struct {
+			Push struct {
+				Branches []string `yaml:"branches"`
+			} `yaml:"push"`
+		} `yaml:"on"`
+		Jobs map[string]struct {
+			ContinueOnError bool `yaml:"continue-on-error"`
+			Steps           []struct {
+				Run string `yaml:"run"`
+			} `yaml:"steps"`
+		} `yaml:"jobs"`
+	}
+	require.NoError(t, yaml.Unmarshal(data, &workflow))
+	assert.Equal(t, []string{"main"}, workflow.On.Push.Branches)
+	require.Len(t, workflow.Jobs, 1)
+	job := workflow.Jobs["shell-burn-down"]
+	assert.True(t, job.ContinueOnError)
+	require.NotEmpty(t, job.Steps)
+	assert.Equal(t, `go run ./cmd/shell-allowlist --summary >> "$GITHUB_STEP_SUMMARY"`, job.Steps[len(job.Steps)-1].Run)
+}