diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 08eef3b..230ec2b 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -103,6 +103,16 @@ Currently, there is no automated test suite. Manual testing is performed by:
 - Exit with appropriate status codes (0 for success, non-zero for errors)
 - Use descriptive echo messages with emojis for user feedback (✅ ❌ ⚠️)
 
+### GitHub Actions Workflows
+
+- Set permissions at the workflow level as the default
+- Only override permissions at the job level when specific jobs need different access
+- Use latest versions of actions (e.g., `actions/checkout@v6`)
+- Use `ubuntu-slim` runner for lightweight, fast-running tasks (linting, formatting, etc.)
+- Use `ubuntu-latest` for resource-intensive or long-running tasks
+- Always set explicit permissions following the principle of least privilege
+- Use custom code over third-party actions when simple and maintainable
+
 ## Known Limitations
 
 - No automated testing infrastructure
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..66c7332
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,54 @@
+name: Shellcheck
+
+on:
+  pull_request:
+    paths:
+      - '**.sh'
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-slim
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      
+      - name: Run shellcheck on changed files
+        run: |
+          # Get the base branch
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          HEAD_SHA="${{ github.sha }}"
+          
+          echo "Comparing $BASE_SHA...$HEAD_SHA"
+          echo ""
+          
+          # Get changed shell scripts
+          CHANGED_FILES=$(git diff --name-only --diff-filter=ACMRT "$BASE_SHA...$HEAD_SHA" | grep '\.sh$' || true)
+          
+          if [ -z "$CHANGED_FILES" ]; then
+            echo "No shell scripts changed in this PR"
+            exit 0
+          fi
+          
+          echo "Changed shell scripts:"
+          echo "$CHANGED_FILES"
+          echo ""
+          
+          # Run shellcheck on each changed file
+          exit_code=0
+          while IFS= read -r file; do
+            if [ -n "$file" ]; then
+              echo "Checking $file..."
+              if ! shellcheck "$file"; then
+                exit_code=1
+              fi
+            fi
+          done <<< "$CHANGED_FILES"
+          
+          exit "$exit_code"