Add opt-in shell lint and format targets

Introduce make lint-shell / fmt-shell with shellcheck and shfmt (-i 2 -ci -bn), normalize first-party scripts, and document the new targets. Keep them out of make lint / fmt. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
2026-07-23 15:51:43 +02:00
parent 9e9272b4ac
commit 570395c4ac
13 changed files with 856 additions and 733 deletions
--- a/contrib/lima/provision.sh
+++ b/contrib/lima/provision.sh
@@ -15,55 +15,53 @@ GO_VERSION="1.26.5"
 NODE_MAJOR=24
 NPM_VERSION="11.8.0"

-GOTESTSUM_VERSION="v1.13.0"
-GOLANGCI_LINT_VERSION="v2.11.3"
 GOW_VERSION="v0.0.0-20260225145757-ff0f6779ab4c"
 MKCERT_VERSION="v1.4.4"

 apt-get update -qq
 apt-get install -y -qq \
-    build-essential \
-    git \
-    curl \
-    jq \
-    parallel \
-    ca-certificates \
-    gnupg \
-    lsb-release \
-    postgresql-client
+  build-essential \
+  git \
+  curl \
+  jq \
+  parallel \
+  ca-certificates \
+  gnupg \
+  lsb-release \
+  postgresql-client

 if ! command -v docker &>/dev/null; then
-    install -m 0755 -d /etc/apt/keyrings
-    curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
-        | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-    chmod a+r /etc/apt/keyrings/docker.gpg
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
+    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+  chmod a+r /etc/apt/keyrings/docker.gpg

-    echo \
-        "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
+  echo \
+    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
        https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
-        | tee /etc/apt/sources.list.d/docker.list > /dev/null
+    | tee /etc/apt/sources.list.d/docker.list >/dev/null

-    apt-get update -qq
-    apt-get install -y -qq \
-        docker-ce \
-        docker-ce-cli \
-        containerd.io \
-        docker-buildx-plugin \
-        docker-compose-plugin
+  apt-get update -qq
+  apt-get install -y -qq \
+    docker-ce \
+    docker-ce-cli \
+    containerd.io \
+    docker-buildx-plugin \
+    docker-compose-plugin

-    systemctl enable --now docker
+  systemctl enable --now docker
 fi

 usermod -aG docker "${LIMA_CIDATA_USER:-lima}" 2>/dev/null || true

 if [ ! -d "/usr/local/go" ] || ! /usr/local/go/bin/go version | grep -q "go${GO_VERSION}"; then
-    rm -rf /usr/local/go
-    ARCH=$(dpkg --print-architecture)
-    curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" \
-        | tar -C /usr/local -xzf -
+  rm -rf /usr/local/go
+  ARCH=$(dpkg --print-architecture)
+  curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" \
+    | tar -C /usr/local -xzf -
 fi

-cat > /etc/profile.d/go.sh << 'GOEOF'
+cat >/etc/profile.d/go.sh <<'GOEOF'
 export PATH="/usr/local/go/bin:$HOME/go/bin:$PATH"
 GOEOF
 chmod +x /etc/profile.d/go.sh
@@ -74,14 +72,14 @@ export HOME="${HOME:-/root}"
 GOBIN=/usr/local/bin /usr/local/go/bin/go install "github.com/mitranim/gow@${GOW_VERSION}"

 if ! command -v node &>/dev/null || ! node --version | grep -q "v${NODE_MAJOR}"; then
-    curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash -
-    apt-get install -y -qq nodejs
+  curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash -
+  apt-get install -y -qq nodejs
 fi

 npm install -g "npm@${NPM_VERSION}"

 if ! command -v mkcert &>/dev/null; then
-    GOBIN=/usr/local/bin /usr/local/go/bin/go install "filippo.io/mkcert@${MKCERT_VERSION}"
+  GOBIN=/usr/local/bin /usr/local/go/bin/go install "filippo.io/mkcert@${MKCERT_VERSION}"
 fi
 mkcert -install 2>/dev/null || true

@@ -102,34 +100,35 @@ mkdir -p /etc/probod

 OAUTH2_SIGNING_KEY_PATH=/etc/probod/oauth2-signing-key.pem
 if [ ! -f "${OAUTH2_SIGNING_KEY_PATH}" ]; then
-    openssl genrsa -out "${OAUTH2_SIGNING_KEY_PATH}" 2048
-    chmod 600 "${OAUTH2_SIGNING_KEY_PATH}"
+  openssl genrsa -out "${OAUTH2_SIGNING_KEY_PATH}" 2048
+  chmod 600 "${OAUTH2_SIGNING_KEY_PATH}"
 fi

 # Load developer-specific overrides (not committed to repo).
 if [ -f /workspace/.sandbox.env ]; then
-    set -a
-    . /workspace/.sandbox.env
-    set +a
+  set -a
+  # shellcheck source=/dev/null
+  . /workspace/.sandbox.env
+  set +a
 fi

 PROBOD_BASE_URL="http://${VM_IP}:8080" \
-PROBOD_AUTH_COOKIE_DOMAIN="${VM_IP}" \
-PROBOD_AUTH_COOKIE_SECURE=false \
-PROBOD_AUTH_COOKIE_SECRET="this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes" \
-PROBOD_AUTH_PASSWORD_PEPPER="this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes" \
-PROBOD_ENCRYPTION_KEY="thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA=" \
-PROBOD_OAUTH2_SERVER_SIGNING_KEY="$(cat "${OAUTH2_SIGNING_KEY_PATH}")" \
-PROBOD_API_CORS_ALLOWED_ORIGINS="http://${VM_IP}:8080,http://${VM_IP}:5173,http://${VM_IP}:5174" \
-PROBOD_AWS_ENDPOINT="http://127.0.0.1:8333" \
-PROBOD_AWS_ACCESS_KEY_ID="probod" \
-PROBOD_AWS_SECRET_ACCESS_KEY="thisisnotasecret" \
-PROBOD_AWS_USE_PATH_STYLE=true \
-PROBOD_ACME_DIRECTORY="https://127.0.0.1:9000/acme/acme/directory" \
-PROBOD_ACME_EMAIL="admin@probo.com" \
-PROBOD_ACME_KEY_TYPE="EC256" \
-PROBOD_ACME_ROOT_CA="$(cat /workspace/compose/step-ca/certs/root_ca.crt)" \
-    /workspace/bin/probod-bootstrap -output /etc/probod/config.yml
+  PROBOD_AUTH_COOKIE_DOMAIN="${VM_IP}" \
+  PROBOD_AUTH_COOKIE_SECURE=false \
+  PROBOD_AUTH_COOKIE_SECRET="this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes" \
+  PROBOD_AUTH_PASSWORD_PEPPER="this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes" \
+  PROBOD_ENCRYPTION_KEY="thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA=" \
+  PROBOD_OAUTH2_SERVER_SIGNING_KEY="$(cat "${OAUTH2_SIGNING_KEY_PATH}")" \
+  PROBOD_API_CORS_ALLOWED_ORIGINS="http://${VM_IP}:8080,http://${VM_IP}:5173,http://${VM_IP}:5174" \
+  PROBOD_AWS_ENDPOINT="http://127.0.0.1:8333" \
+  PROBOD_AWS_ACCESS_KEY_ID="probod" \
+  PROBOD_AWS_SECRET_ACCESS_KEY="thisisnotasecret" \
+  PROBOD_AWS_USE_PATH_STYLE=true \
+  PROBOD_ACME_DIRECTORY="https://127.0.0.1:9000/acme/acme/directory" \
+  PROBOD_ACME_EMAIL="admin@probo.com" \
+  PROBOD_ACME_KEY_TYPE="EC256" \
+  PROBOD_ACME_ROOT_CA="$(cat /workspace/compose/step-ca/certs/root_ca.crt)" \
+  /workspace/bin/probod-bootstrap -output /etc/probod/config.yml

 # probod runs as ${LIMA_USER} but bootstrap writes config.yml as root with 0600
 # because it contains secrets. Transfer ownership so probod can read it.
@@ -137,7 +136,7 @@ chown "${LIMA_USER}:${LIMA_USER}" /etc/probod/config.yml "${OAUTH2_SIGNING_KEY_P

 # Bind-mount VM-local node_modules over the shared workspace to avoid
 # platform conflicts between macOS host and Linux VM native binaries.
-cat > /etc/systemd/system/probo-node-modules.service << EOF
+cat >/etc/systemd/system/probo-node-modules.service <<EOF
 [Unit]
 Description=Bind-mount VM-local node_modules over workspace
 DefaultDependencies=no
@@ -167,11 +166,11 @@ su - "${LIMA_USER}" -c "cd /workspace && npm ci"
 make -C /workspace generate WITH_APPS=1
 make -C /workspace embed

-echo "VITE_API_URL=http://${VM_IP}:8080" > /workspace/apps/console/.env
-echo "VITE_API_URL=http://${VM_IP}:8080" > /workspace/apps/compliance-portal/.env
+echo "VITE_API_URL=http://${VM_IP}:8080" >/workspace/apps/console/.env
+echo "VITE_API_URL=http://${VM_IP}:8080" >/workspace/apps/compliance-portal/.env

 # Install systemd services for the sandbox
-cat > /etc/systemd/system/probo-stack.service << EOF
+cat >/etc/systemd/system/probo-stack.service <<EOF
 [Unit]
 Description=Probo Docker Compose Stack
 Requires=docker.service
@@ -191,7 +190,7 @@ RestartSec=5s
 WantedBy=multi-user.target
 EOF

-cat > /etc/systemd/system/probod.service << EOF
+cat >/etc/systemd/system/probod.service <<EOF
 [Unit]
 Description=Probo API Server
 Requires=probo-stack.service
@@ -211,7 +210,7 @@ Environment=PATH=/usr/local/go/bin:/usr/local/bin:/usr/bin:/bin
 WantedBy=multi-user.target
 EOF

-cat > /etc/systemd/system/probo-console.service << EOF
+cat >/etc/systemd/system/probo-console.service <<EOF
 [Unit]
 Description=Probo Console Dev Server
 Requires=probo-node-modules.service
@@ -229,7 +228,7 @@ RestartSec=3s
 WantedBy=multi-user.target
 EOF

-cat > /etc/systemd/system/probo-compliance-portal.service << EOF
+cat >/etc/systemd/system/probo-compliance-portal.service <<EOF
 [Unit]
 Description=Probo Compliance Portal Dev Server
 Requires=probo-node-modules.service