In the past we've tried to avoid using unofficial pre-packaged Actions in our workflows. In this case it looks like the package hasn't been updated in ~1 year. And in general IMO it's good to avoid external dependencies outside of our control when it's easy enough to do so.

I think we should probably just do exactly what we do for the Buildkite job which is:

- 'apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y shellcheck'
- 'shopt -s globstar'
- 'shellcheck -x -P SCRIPTDIR **/*.sh'