From fb68b325d65ed4e04a6678d10e635af3422f2419 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Sat, 13 Dec 2025 14:08:35 +0100
Subject: [PATCH] Fix ShellCheck warnings and harden shell scripts

- Quote Docker volume names to avoid word splitting
- Add missing shebangs for proper shell detection
- Annotate sourced scripts for ShellCheck resolution
- Remove unused variables
- Explicitly disable SC2016 where literal RC strings are intended
- Improve robustness of cleanup logic

https://chatgpt.com/share/693d6557-a080-800f-8915-c57476569232
---
 Makefile                |  2 +-
 scripts/build/image.sh  |  2 ++
 scripts/docker/entry.sh |  2 --
 scripts/nix/init.sh     | 21 +++++++++++++--------
 scripts/setup/nix.sh    |  2 ++
 scripts/setup/venv.sh   |  1 +
 6 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/Makefile b/Makefile
index 90bd8d4..0895470 100644
--- a/Makefile
+++ b/Makefile
@@ -101,7 +101,7 @@ test-env-nix: build-missing
 test: test-env-virtual test-unit test-integration test-e2e
 
 delete-volumes: 
-	@docker volume rm pkgmgr_nix_store_${distro} pkgmgr_nix_cache_${distro} || true
+	@docker volume rm "pkgmgr_nix_store_${distro}" "pkgmgr_nix_cache_${distro}" || echo "No volumes to delete."
 
 purge: delete-volumes build-no-cache
 
diff --git a/scripts/build/image.sh b/scripts/build/image.sh
index f998834..3dbc200 100755
--- a/scripts/build/image.sh
+++ b/scripts/build/image.sh
@@ -2,6 +2,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# shellcheck source=./scripts/build/base.sh
 source "${SCRIPT_DIR}/base.sh"
 
 : "${distro:?Environment variable 'distro' must be set (arch|debian|ubuntu|fedora|centos)}"
diff --git a/scripts/docker/entry.sh b/scripts/docker/entry.sh
index 5c31bcf..dc37208 100755
--- a/scripts/docker/entry.sh
+++ b/scripts/docker/entry.sh
@@ -1,8 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
 echo "[docker] Starting package-manager container"
 
 # ---------------------------------------------------------------------------
diff --git a/scripts/nix/init.sh b/scripts/nix/init.sh
index f2fa900..a569865 100755
--- a/scripts/nix/init.sh
+++ b/scripts/nix/init.sh
@@ -1,22 +1,27 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# shellcheck source=lib/bootstrap_config.sh
-# shellcheck source=lib/detect.sh
-# shellcheck source=lib/path.sh
-# shellcheck source=lib/symlinks.sh
-# shellcheck source=lib/users.sh
-# shellcheck source=lib/install.sh
-# shellcheck source=lib/nix_conf_file.sh
-
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
+# shellcheck source=./scripts/nix/lib/bootstrap_config.sh
 source "${SCRIPT_DIR}/lib/bootstrap_config.sh"
+
+# shellcheck source=./scripts/nix/lib/detect.sh
 source "${SCRIPT_DIR}/lib/detect.sh"
+
+# shellcheck source=./scripts/nix/lib/path.sh
 source "${SCRIPT_DIR}/lib/path.sh"
+
+# shellcheck source=./scripts/nix/lib/symlinks.sh
 source "${SCRIPT_DIR}/lib/symlinks.sh"
+
+# shellcheck source=./scripts/nix/lib/users.sh
 source "${SCRIPT_DIR}/lib/users.sh"
+
+# shellcheck source=./scripts/nix/lib/install.sh
 source "${SCRIPT_DIR}/lib/install.sh"
+
+# shellcheck source=./scripts/nix/lib/nix_conf_file.sh
 source "${SCRIPT_DIR}/lib/nix_conf_file.sh"
 
 echo "[init-nix] Starting Nix initialization..."
diff --git a/scripts/setup/nix.sh b/scripts/setup/nix.sh
index a3dd975..7fb2fa6 100755
--- a/scripts/setup/nix.sh
+++ b/scripts/setup/nix.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # ------------------------------------------------------------
 # Nix shell mode: do not touch venv, only run install
 # ------------------------------------------------------------
diff --git a/scripts/setup/venv.sh b/scripts/setup/venv.sh
index c577f7b..3fd41c1 100755
--- a/scripts/setup/venv.sh
+++ b/scripts/setup/venv.sh
@@ -7,6 +7,7 @@ PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "${PROJECT_ROOT}"
 
 VENV_DIR="${HOME}/.venvs/pkgmgr"
+# shellcheck disable=SC2016
 RC_LINE='if [ -d "${HOME}/.venvs/pkgmgr" ]; then . "${HOME}/.venvs/pkgmgr/bin/activate"; if [ -n "${PS1:-}" ]; then echo "Global Python virtual environment '\''~/.venvs/pkgmgr'\'' activated."; fi; fi'
 
 # ------------------------------------------------------------