Krzysztof Rudnicki a778b66b15 Fail the build on any shellcheck finding; fix the 222 the old gate hid ... The shellcheck hook ran with --severity=warning, so info- and style-level findings never failed a commit. 222 had accumulated across 94 of 244 shell files. They were not all style noise -- six were bugs: - Five scripts in single_use/misc/testsAndMisc-bash/ sourced $SCRIPT_DIR/../../lib/common.sh, one directory too shallow. Nothing exists at that path, so all five failed at runtime. - setup_personal_website.sh and setup_kcd2_dice_solver.sh called usage() (which ends in `exit 0`) and then `exit 1` for an unknown command. The exit 1 was unreachable, so a typo'd subcommand reported SUCCESS. - Six i3blocks scripts had a `# shellcheck source=` directive missing the scripts/periodic_background/ path segment. The stale path had silently disabled source-following for all of them. - diagnose_arch_performance.sh word-split a newline-joined file list; when the find came back empty, awk got no file operands, fell through to reading stdin, and the diagnostic hung. - lib/common.sh's handle_arg_help_or_unknown ended in an unreachable `return 0` while documenting "Returns: 0 if handled" -- a contract no code path could satisfy. - deploy.sh's SCRIPT_DIR is reassigned by config.sh, which it sources at top level, and config.sh can repoint it at the on-device path /data/local/tmp/focus_mode. Renamed to DEPLOY_DIR. The SC1091 bulk (81 findings) was resolved rather than silenced: .shellcheckrc sets external-sources + source-path=SCRIPTDIR so sourced files are actually followed and analysed. That is what surfaced the i3blocks and deploy.sh bugs. 17 `# shellcheck disable=` directives remain, each with a written reason, and only where the finding is provably wrong: injection-test payloads that must not expand, literal source text being grepped for, POSIX sh scripts on the phone where arrays do not exist, and source paths that only exist at runtime. Everything else was fixed in code. Verified in a CLEAN worktree, not just my own tree. config.sh sources the gitignored config_secrets.sh, which exists locally but not in a fresh checkout; a working-tree-only check passed while ci_mirror.sh -- which lints HEAD in a clean worktree, exactly as CI does -- failed on it. The gate is verified to bite: a file whose only finding is SC2016 (info) fails the hook, while the old --severity=warning gate exits 0 on it. third_party/ is excluded -- vendored upstream, matching the prettier hook. Not fixed, reported: check_polling_antipatterns.sh carries a pre-existing SC2034 disable that hides a real bug -- its `patterns` array is never used, so the checker detects nothing. Confirmed unchanged by this commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>		2026-08-03 19:49:11 +02:00
..
install_plagiarism_tools.sh	Fail the build on any shellcheck finding; fix the 222 the old gate hid	2026-08-03 19:49:11 +02:00