ci: Check that non-scripts aren’t marked executable.

Signed-off-by: Anders Kaseorg <anders@zulip.com>

.github/workflows/zulip-ci.yml

@@ -150,6 +150,7 @@ jobs:
           ./tools/test-migrations
           ./tools/setup/optimize-svg --check
           ./tools/setup/generate_integration_bots_avatars.py --check-missing
+          ./tools/ci/check-executables
 
           # Ban check-database-compatibility.py from transitively
           # relying on static/generated, because it might not be

tools/ci/check-executables

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+files="$(git ls-tree -r @ | sed -n 's/^100755 blob \S\+\t//p' | xargs -r grep -Lz '^#!' --)" || [ $? = 123 ]
+if [ "$files" ]; then
+    echo 'error: non-scripts should not be marked executable (fix with chmod -x):'
+    echo
+    printf '%s\n' "$files"
+    exit 1
+fi