fix(ci): unblock the check job — shellcheck OOM + missing dashboard dep install

[webdevtodayjason]

CI's check job has been red on main since ~May 28. Because the job is sequential, a single early failure masked everything after it. This PR fixes the chain so the job runs green end-to-end.

Fix 1 — shellcheck OOM (the visible failure)

The Shellcheck step ran ~76 min then signal 9 (OOM). Root cause: shellcheck follows a source statement whenever the target is also in the input list, regardless of -x. bin/subctl sources the whole lib/ tree, so the single xargs invocation built a runaway source graph. The macos-15-arm64 image rotation (20260527) lowered RAM headroom enough to tip slow→OOM (matching the onset).

• Check bin/subctl in its own invocation, without -x (no source targets co-present → ~0.2s).
• Add # shellcheck shell=bash to the 6 no-shebang sourced libs so they pass standalone.

✅ Confirmed on the runner: in the first #52 run the Shellcheck step went green and the job reached the next step in ~30s.

Fix 2 — dashboard build-check had no bun install (masked downstream failure)

With shellcheck unblocked, the next step failed: bun build dashboard/server.ts with no prior install → Could not resolve: @earendil-works/pi-ai / smol-toml / shell-quote. This had been failing the whole time, hidden behind the OOM.

• Add a bun install --frozen-lockfile for components/evy and dashboard (both have committed bun.lock) before the build-check.

Validation (local, runner-identical env)

• shellcheck: batch 5.5s + bin/subctl 0.2s, both exit 0 (was 76-min OOM)
• frozen installs: exit 0, lockfiles in sync
• bun build dashboard/server.ts: bundles 2006 modules
• deck go vet ./... + go build: exit 0

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated CI workflow to change how shellcheck runs on macOS runners—separating a problematic script to avoid resource issues and adding explanatory comments about the behavior.
  • Added shellcheck directives to multiple shell scripts to improve linting configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cbe0a1cb-7952-4f8e-affb-4f3f42a0efcd

📥 Commits

Reviewing files that changed from the base of the PR and between cb6ca6d and 6f3ee91.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The PR reconfigures shellcheck linting to prevent out-of-memory failures on macOS: the CI workflow splits shellcheck execution (batch checking all scripts except bin/subctl with -x, then checking bin/subctl separately without -x), and six library files each receive a # shellcheck shell=bash directive for consistent linting context.

Changes

ShellCheck Configuration

Layer / File(s)	Summary
CI workflow split shellcheck strategy .github/workflows/ci.yml	The check job's shellcheck step now excludes bin/subctl from the batch run with -x and performs a separate shellcheck invocation on bin/subctl without -x, with comments explaining this avoids macOS runner OOM caused by expanded source graphs.
Library files shell type directives lib/backfill.sh, lib/cognee.sh, lib/memori.sh, lib/memory-kernel.sh, lib/memory-tier1.sh, lib/voice.sh	Each library script receives an identical # shellcheck shell=bash directive at the first line to explicitly configure ShellCheck to analyze the scripts as Bash.

🎯 2 (Simple) | ⏱️ ~10 minutes

🐰 Six scripts now speak Bash so clear,
The CI split avoids the OOM fear,
ShellCheck directives, a cohesive sight,
Linting the library scripts just right!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely summarizes the main fix: addressing the shellcheck OOM issue that was blocking the CI check job and adding missing dashboard dependency installation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ci-shellcheck-binsubctl-hang

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}