add shellcheck to CI, resolve warnings

.github/workflows/ci.yml

@@ -107,3 +107,11 @@ jobs:
       uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
       with:
         files: lcov.info
+  # Lint shell scripts
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+    - name: Run shellcheck
+      uses: ludeeus/[email protected]

scripts/publish-release.sh

@@ -33,27 +33,27 @@ release_tag="${GITHUB_REF:10}"
 
 # prepare artifacts
 pushd output
-mv $release_input $release_target
-shasum -a 256 $release_target > $release_target_hash
+mv $release_input "$release_target"
+shasum -a 256 "$release_target" > "$release_target_hash"
 popd
 
 # prepare release
 ORG="filecoin-project"
 REPO="builtin-actors"
 
 # see if the release already exists by tag
-__release_response=`
+__release_response=$(
   curl \
    --header "Authorization: token $GITHUB_TOKEN" \
    "https://api.github.com/repos/$ORG/$REPO/releases/tags/$release_tag"
-`
-__release_id=`echo $__release_response | jq '.id'`
+)
+__release_id=$(echo "$__release_response" | jq '.id')
 if [ "$__release_id" = "null" ]; then
     echo "release $release_tag does not exist"
     exit 1
 fi
 
-__release_upload_url=`echo $__release_response | jq -r '.upload_url' | cut -d'{' -f1`
+__release_upload_url=$(echo "$__release_response" | jq -r '.upload_url' | cut -d'{' -f1)
 
 echo "uploading $release_target"
 curl \