test: bats unit suite + shellcheck CI gating Docker publish

[PhilippMundhenk]

Summary

Adds focused shell-script test coverage and wires it into the publish workflows so a Docker image can no longer be built/pushed if static analysis or unit tests fail. Also fixes the real bugs in existing scripts that shellcheck surfaced.

What is tested

Script	Covered behaviour
trigger_telegram.sh	env gating (token/chatid), correct token URL, url-encoded POST body
trigger_inotify.sh	env gating, sshpass argv contains user@host + remote path, non-zero exit on ssh failure
sendtoftps.sh	env gating, curl invoked with credentials/URL/file, non-zero exit + diagnostic output on failure
remove_blank.sh	no-op when REMOVE_BLANK_THRESHOLD unset; pdfinfo/gs/pdftk pipeline runs when set
scantoemail-0.2.4-1.sh	trigger banner is logged and scanRear.sh is invoked with forwarded argv
scantoocr.sh / scantoimage.sh	placeholder scripts still emit the "not implemented" notice
All shell scripts	parse with bash -n; script/ files keep the executable bit; Dockerfile copies script/ into the image and installs pdfinfo/gs/pdftk

Mocking is done by shadowing external commands (curl, wget, sshpass, pdfinfo, gs, pdftk, nawk, bc) via a PATH-prefixed sandbox directory — see tests/helpers/common.bash for mock_command / mock_record.

CI integration

test.yml gains a workflow_call trigger so the three existing publish workflows (publishMaster, publishBranchesPRs, publishTags) can each declare a tests job that reuses it, with needs: tests on the build job. A shellcheck or bats failure now aborts the Docker build instead of silently shipping a broken image.

Drive-by fixes uncovered by shellcheck

Running shellcheck --severity=error against the existing scripts flagged real bugs. Fixed in this PR so CI is green from day one:

• Missing shebangs in run.sh, update-container.sh, script/sendtoftps.sh, script/trigger_inotify.sh.
• Unquoted array expansion in script/scanRear.sh and script/scantofile-0.2.4-1.sh (gm convert ${gm_opts[@]} → "${gm_opts[@]}").
• Unquoted $@ in script/scantoemail-0.2.4-1.sh (would drop spaces in a forwarded friendly-name).
• exit -1 in files/runScanner.sh → exit 1 (exit codes are 0–255).
• Broken NAME default in files/runScanner.sh: if [[ -z {$NAME} ]]; then $NAME="Scanner"; fi — literal braces meant the test was always false (SC2157) and the LHS was a syntax error when NAME is empty (SC2281). Replaced with the intended if [[ -z "$NAME" ]]; then NAME="Scanner"; fi. Rarely triggered because the Dockerfile sets ENV NAME="Scanner", but now it actually works.

What is not covered

The full scantofile / scanRear scan pipeline (would need hours of mocked-up fixtures or live hardware), runScanner.sh interface detection (deeply tied to host networking), and the lighttpd PHP front-end. Worth a follow-up if you want broader coverage.

The OCR queue tests will land with #85 once that PR merges; this branch is based on master and so doesn't see the queue scripts yet.

Test plan

• bats tests/unit — all green in CI.
• shellcheck --severity=error — clean in CI.
• Confirm make test / make lint work locally for a maintainer with bats and shellcheck installed.
• Verify publish workflows actually wait on tests (this will be visible the next time any of them runs).

🤖 Generated with Claude Code