build: enforce portable line endings

scripts/test-verify-line-endings.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+fixture_root="$(mktemp -d)"
+trap 'rm -rf "$fixture_root"' EXIT
+
+printf '#!/bin/sh\nexit 0\n' > "$fixture_root/ok.sh"
+printf '#!/bin/sh\r\nexit 0\r\n' > "$fixture_root/bad.sh"
+printf 'services:\r\n  app:\r\n    image: example\r\n' > "$fixture_root/compose.yaml"
+printf 'FROM scratch\r\n' > "$fixture_root/Dockerfile"
+
+set +e
+output="$("$repo_root/scripts/verify-line-endings.sh" "$fixture_root" 2>&1)"
+status=$?
+set -e
+
+if [[ $status -eq 0 ]]; then
+  echo "expected CRLF rejection" >&2
+  exit 1
+fi
+
+for expected_path in bad.sh compose.yaml Dockerfile; do
+  if ! grep -Fqx "$expected_path" <<< "$output"; then
+    echo "missing CRLF path: $expected_path" >&2
+    exit 1
+  fi
+done
+
+if grep -Fq 'ok.sh' <<< "$output"; then
+  echo "reported LF-only path: ok.sh" >&2
+  exit 1
+fi
+
+printf '#!/bin/sh\nexit 0\n' > "$fixture_root/bad.sh"
+printf 'services:\n  app:\n    image: example\n' > "$fixture_root/compose.yaml"
+printf 'FROM scratch\n' > "$fixture_root/Dockerfile"
+
+"$repo_root/scripts/verify-line-endings.sh" "$fixture_root"
+
+echo "line-ending verifier tests passed"