From ebe0e597a543ef0082b3869cc333a83d579c2cd0 Mon Sep 17 00:00:00 2001
From: Preston Hunt <me@prestonhunt.com>
Date: Fri, 28 Aug 2026 12:29:53 -0700
Subject: [PATCH] ci: run shellcheck, and fix the three issues it found

Adds a GitHub Actions job that shellchecks the bash scripts (setup,
create-gruvbox) and syntax-checks the zsh files with 'zsh -n'.
shellcheck cannot parse zsh, so those are only syntax-checked.

The three findings on setup, all fixed here:

  SC2174 (warning) 'mkdir -p "$HOME"/.ssh --mode 700' -- with -p, -m
    applies only to the deepest directory created, and not at all when
    the directory already exists. ~/.ssh could therefore end up with
    default permissions, which ssh refuses to use. Split into mkdir -p
    followed by an unconditional chmod 700.

  SC2086 unquoted $HOME/.gitconfig in setup_git.

  SC2016 '#https_proxy=$http_proxy' is intentionally single-quoted --
    it writes a commented template line to /etc/environment -- so it
    gets an explanatory disable directive rather than a change.

Note shellcheck is narrower than I first assumed: it does not catch the
logic bugs fixed on the other branches (a destination-less git clone,
'-f' against a directory, '-d' against a file), since all are
well-formed shell. Verified locally with shellcheck 0.10.0: clean exit
on both scripts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/shellcheck.yml | 26 ++++++++++++++++++++++++++
 setup                            | 12 ++++++++----
 2 files changed, 34 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/shellcheck.yml

diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..0428d6b
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,26 @@
+name: shellcheck
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install shellcheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+
+      # Only the bash scripts. prestobuntu.zsh, p10k.zsh, zpreztorc and
+      # tmux-new-session.plugin.zsh are zsh, which shellcheck cannot parse.
+      - name: Lint bash scripts
+        run: shellcheck setup create-gruvbox
+
+      - name: Check zsh syntax
+        run: |
+          sudo apt-get install -y zsh
+          zsh -n prestobuntu.zsh
+          zsh -n tmux-new-session.plugin.zsh
diff --git a/setup b/setup
index df939ed..83d86de 100755
--- a/setup
+++ b/setup
@@ -196,7 +196,8 @@ setup_ssh() {
     install_package openssh-server mosh
 
     if [[ -v SSH_REMOTE_ACCESS_PUBKEY ]]; then
-        mkdir -p "$HOME"/.ssh --mode 700
+        mkdir -p "$HOME"/.ssh
+        chmod 700 "$HOME"/.ssh
         touch "$HOME"/.ssh/authorized_keys
         _require_line "$SSH_REMOTE_ACCESS_PUBKEY" "$HOME"/.ssh/authorized_keys
         chmod 600 "$HOME"/.ssh/authorized_keys
@@ -216,7 +217,7 @@ setup_ssh() {
 
 setup_git() {
     install_package git git-lfs
-    get_prestobuntu_file gitconfig $HOME/.gitconfig
+    get_prestobuntu_file gitconfig "$HOME/.gitconfig"
 }
 
 get_internet_file() {
@@ -510,11 +511,14 @@ disable_sleep() {
 
 create_environment_proxy_entries() {
     local file="/etc/environment"
-    if ! grep -q http_proxy $file; then
+    if ! grep -q http_proxy "$file"; then
         echo '#http_proxy=http://192.168.250.10:8888' | sudo tee -a "$file"
     fi
 
-    if ! grep -q https_proxy $file; then
+    if ! grep -q https_proxy "$file"; then
+        # single quotes are deliberate: this writes a commented-out
+        # template line, so $http_proxy must land in the file literally
+        # shellcheck disable=SC2016
         echo '#https_proxy=$http_proxy' | sudo tee -a "$file"
     fi
 }