[2014] Move the upgrade scan action here, with examples and an AI prompt

.github/workflows/test.yml

@@ -0,0 +1,20 @@
+name: Test
+on:
+  push:
+    branches: [main]
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install tools
+        run: sudo apt-get update -q && sudo apt-get install -y -q bats shellcheck php-cli
+      - name: Shellcheck
+        run: shellcheck scripts/*.sh */scan.sh tests/*/stubs/*
+      - name: Tests
+        run: bats tests/*/*.bats

README.md

@@ -0,0 +1,48 @@
+# Sentinel actions
+
+CI actions and templates for [Sentinel](https://sentinelconnector.io), for
+GitHub Actions and GitLab CI. Each runs in your own pipeline and your own site
+image, and sends Sentinel only what that check needs.
+
+| Action | What it does | GitHub Actions | GitLab CI |
+|---|---|---|---|
+| [Upgrade scan](upgrade-scan) | Drupal upgrade readiness from Upgrade Status, without installing it on production. | `truecms/sentinel-actions/upgrade-scan@v1.0.0` | `upgrade-scan/gitlab.yml` |
+
+Each action folder has:
+
+- the GitHub action (`action.yml`) and the GitLab template (`gitlab.yml`),
+- `examples/` with a complete GitHub workflow and GitLab job,
+- `prompts/` with an AI prompt you paste into your coding assistant, opened in
+  your repository, to add the job for you.
+
+## Pin a release
+
+Releases cover the whole repository: `v1.0.0`, `v1.1.0` and so on. Use a tag
+you have reviewed, or a full commit SHA:
+
+```yaml
+- uses: truecms/sentinel-actions/upgrade-scan@<full commit SHA>
+```
+
+GitLab templates download their script from the same tag and check its
+SHA-256 before they run it.
+
+## Secrets
+
+Every credential goes into a CI secret (GitHub repository secret, or a masked
+and protected GitLab CI/CD variable). Never write one into a file, a commit or
+an AI chat. The actions never print them.
+
+## Development
+
+```bash
+shellcheck scripts/*.sh */scan.sh tests/*/stubs/*
+bats tests/*/*.bats
+```
+
+To release: run `scripts/pin-release.sh vX.Y.Z`, commit, then tag `vX.Y.Z`.
+
+## Licence
+
+MIT. See [LICENSE](LICENSE). Report security problems as described in
+[SECURITY.md](SECURITY.md).

scripts/pin-release.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Writes the release tag and each script's SHA-256 into every GitLab template.
+# Run it in the release commit, before tagging: scripts/pin-release.sh v1.2.0
+set -euo pipefail
+
+tag="${1:-}"
+[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo 'Usage: scripts/pin-release.sh vX.Y.Z' >&2; exit 1; }
+
+root="$(cd "$(dirname "$0")/.." && pwd)"
+sha256() {
+  if command -v sha256sum > /dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+}
+
+for template in "$root"/*/gitlab.yml; do
+  dir="$(dirname "$template")"
+  # Each template runs the scan.sh beside it.
+  sum="$(sha256 "$dir/scan.sh")"
+  sed -i.bak \
+    -e "s/^\(    SENTINEL_ACTIONS_REF:\).*/\1 $tag/" \
+    -e "s/^\(    SENTINEL_SCRIPT_SHA256:\).*/\1 $sum/" \
+    "$template"
+  rm -f "$template.bak"
+  echo "$(basename "$dir")/gitlab.yml now runs scan.sh $tag ($sum)."
+done