feat: build CouchOS Melee appliance

scripts/check.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+export PYTHONPATH="${REPO_ROOT}/src${PYTHONPATH:+:${PYTHONPATH}}"
+
+run_step() {
+  local label="$1"
+  shift
+  printf '[check] %s\n' "${label}"
+  "$@"
+}
+
+secret_scan() {
+  python3 - "${REPO_ROOT}" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+root = Path(sys.argv[1])
+rom_suffixes = (".iso", ".gcm", ".wbfs", ".nkit.iso")
+secret_pattern = re.compile(
+    r"BEGIN [A-Z ]+PRIVATE KEY|Authorization:\s*Bearer\s+[A-Za-z0-9._~-]{20,}"
+)
+findings: list[str] = []
+for path in root.rglob("*"):
+    if not path.is_file() or any(part in {".git", "__pycache__", "artifacts"} for part in path.parts):
+        continue
+    relative = path.relative_to(root)
+    if path.name.lower().endswith(rom_suffixes):
+        findings.append(f"ROM file: {relative}")
+        continue
+    if relative in {Path("templates/couchd.token.example"), Path("scripts/check.sh")}:
+        continue
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (UnicodeDecodeError, OSError):
+        continue
+    if secret_pattern.search(text):
+        findings.append(f"possible secret: {relative}")
+if findings:
+    print("\n".join(findings))
+    raise SystemExit(1)
+PY
+}
+
+run_step "unit tests" python3 -m unittest discover -v
+run_step "setup shell tests" bash "${REPO_ROOT}/tests/test_setup_modes.sh"
+run_step "shell syntax" bash -n "${REPO_ROOT}/setup.sh" "${REPO_ROOT}"/scripts/*.sh
+run_step "python compile" python3 -m py_compile "${REPO_ROOT}"/src/couchd/*.py "${REPO_ROOT}"/tests/*.py
+if command -v node >/dev/null 2>&1; then
+  run_step "dashboard JS syntax" node --check "${REPO_ROOT}/dashboard/app.js"
+else
+  printf '[check] dashboard JS syntax skipped: node not installed\n'
+fi
+if git -C "${REPO_ROOT}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  run_step "git diff check" git -C "${REPO_ROOT}" diff --check
+else
+  printf '[check] git diff check skipped: deployed tree has no .git directory\n'
+fi
+run_step "secret and ROM scan" secret_scan