ci: run the finalize-release shell tests

[mehmetkr-31]

Closes #248.

Rescoped after review. This PR originally wired up both orphaned shell suites. @osr21 pointed out that #247 (@wolfgang1211, opened before #248) already covers the arcup half — and covers it better: a glob-discovering make test-arcup, test-all integration, and shellcheck over arcup/arcup and arcup/install. It also anchored its job at the same place in ci.yml, so both merging would have conflicted and run the arcup suite twice per pass. Scoped down to the finalize-release suite, which #247 does not touch. My mistake for not checking open PRs before filing — I swept the issue tracker and stopped there.

Summary

.github/scripts/test-finalize-release.sh covers the release finalizer's tag and version parsing, and nothing invokes it:

$ grep -rn "test-finalize-release" .github/ Makefile | grep -v "^.github/scripts/test-finalize-release.sh"
(no matches)

Adds a make test-finalize-release target and a standalone Release Finalizer job that calls it. No toolchain, no network, no needs: — runs in parallel and finishes in seconds.

Composing with #247

The target deliberately mirrors #247's test-arcup shape, and the two changes are anchored apart so they merge in either order:

	#247	this PR
ci.yml job	after proto	before docker-build
Makefile target	before test-all	after test-all

test-all is left alone on purpose — it is the one line both PRs would otherwise touch. Adding test-finalize-release to it is a clean follow-up once #247 lands, and I am happy to open that.

Testing

$ make test-finalize-release
running finalize-release tests...
finalize-release tests passed
exit 0

Verified on macOS here. @osr21 ran both suites on Linux (GNU coreutils/tar, bash 5) during review and reported finalize-release tests passed, exit 0 — so the macOS-only caveat from the first revision is closed and the first ubuntu-latest run should be green rather than exploratory.

[osr21]

Reviewed against a fresh clone of main and against #247's diff. Everything technically claimed here holds; the one real issue is coordination, not correctness.

Verified:

• Both suites are indeed referenced nowhere — grep -rn for test_arcup and test-finalize-release outside the scripts themselves comes back empty across the whole tree, .github/ and Makefile included.
• Your macOS-only caveat is closed: I ran both suites on Linux (GNU coreutils/tar, bash 5). arcup/test_arcup.sh → 25/25 ok, exit 0; .github/scripts/test-finalize-release.sh → finalize-release tests passed, exit 0. The sha256sum/shasum and GNU/BSD tar branching works, so the first ubuntu-latest run should be green rather than "the confirming check."
• The pinned checkout SHA (df4cb1c0… # v6.0.3) matches the exact convention used by all ten existing jobs in ci.yml, and a dependency-free parallel job fits the workflow's structure (no needs:, no toolchain).

The blocking concern: this overlaps #247, opened ~2h before the issue this PR closes. That PR wires the arcup suite into CI via make test-arcup (glob-based, so future arcup/*_test.sh files are picked up automatically), adds it to test-all, and runs shellcheck over arcup/arcup and arcup/install. I diffed both PRs: they insert their job at the same anchor in ci.yml (after the docker job), so whichever merges second conflicts, and if both merged the arcup suite would run twice per CI pass. Details in my comment on #248.

Suggested resolution — which keeps this PR's genuinely novel contribution intact: #247 is a strict superset on the arcup half (CI + Makefile + lint), but it does not touch test-finalize-release.sh — that coverage exists only here. So the clean split is to slim this PR to the finalize-release suite: either keep shell-tests as a small job running just that script, or coordinate with @wolfgang1211 to add it as one extra step in his job. Since you offered a make target restructure in the PR description anyway: a make test-finalize-release target mirroring #247's test-arcup pattern would make the two PRs compose neatly instead of collide.

Happy to re-verify whichever shape this lands in.

[mehmetkr-31]

Thanks — you were right on both counts, and the Linux run is genuinely useful: that closes the one caveat I could not resolve here (no Docker, no Linux box), so the first ubuntu-latest run should now be confirmation rather than exploration.

On the overlap: my mistake, and worth naming precisely so I do not repeat it. I swept the issue tracker for anything already claiming this ground and stopped there — I never checked open PRs. #247 predates my issue by about two hours, so the collision was entirely avoidable.

Rescoped to the finalize-release half. #247 is the better answer on arcup — glob discovery so future arcup/*_test.sh files get picked up for free, test-all integration, and shellcheck on top, none of which my version had.

Anchored the two changes apart so they merge in either order rather than racing:

	#247	here
ci.yml job	after proto	before docker-build
Makefile	before test-all	after test-all

I left test-all untouched deliberately — it is the single line both PRs would otherwise fight over. Adding test-finalize-release to it is a one-line follow-up once #247 lands, and I will open it then unless @wolfgang1211 would rather fold it into his.

[osr21]

Re-verified the rescoped shape (550bca6b) as promised — it all holds:

• Clean composition with ci: run arcup installer shell tests and shellcheck #247 confirmed. Diffed both against main: your ci.yml job now anchors after the Foundry job (line 244 context) while ci: run arcup installer shell tests and shellcheck #247's sits after the docker job (line 158 context), and your Makefile target lands after test-all while his lands before it. Distinct anchors on both files — git merges these in either order without conflict, and no suite runs twice.
• make test-finalize-release works from a fresh clone of your branch — running finalize-release tests... → finalize-release tests passed, exit 0. Recipe lines are real tabs (checked with cat -A), and the target mirrors ci: run arcup installer shell tests and shellcheck #247's pattern (.PHONY, ## help comment, @-prefixed recipe) so the Makefile stays stylistically consistent.
• Leaving test-all untouched is the right call for exactly the reason you named — it's the one line both PRs would otherwise race on. The one-line follow-up after ci: run arcup installer shell tests and shellcheck #247 lands is the cheapest possible resolution.

One tiny observation, take it or leave it: release-finalizer runs a script that lives under .github/scripts/, so unlike the arcup job it's guarding release tooling rather than something operators execute — arguably it could use paths filtering to skip on unrelated PRs. But the suite runs in ~1s on a bare runner, so the complexity isn't worth it; flagging only so it's a considered decision rather than an omission.

With the overlap resolved, both PRs are now independently mergeable and jointly complete: #247 covers the installer half (tests + lint + test-all), this covers the finalizer half. Nothing further from me — LGTM for maintainer review.