chore(ci): add CI fmt/shellcheck lints

.github/workflows/lint.yml

@@ -0,0 +1,39 @@
+name: Lint
+on:
+  pull_request:
+  push:
+    branches:
+    - main
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    env:
+      SHFMT_VERSION: "3.12.0"
+      BLACK_VERSION: "26.5.1"
+      SHELLCHECK_VERSION: "0.11.0"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      # Pin tool versions to match the local formatter; a version skew would
+      # reformat differently and flip the gate red on already-formatted code.
+      - name: Install tools
+        run: |
+          mkdir -p "${HOME}/.local/bin"
+          echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"
+          curl -sSfL "https://github.com/mvdan/sh/releases/download/v${SHFMT_VERSION}/shfmt_v${SHFMT_VERSION}_linux_amd64" -o "${HOME}/.local/bin/shfmt"
+          chmod +x "${HOME}/.local/bin/shfmt"
+          curl -sSfL "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | tar -xJ -C /tmp
+          install -m755 "/tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck" "${HOME}/.local/bin/shellcheck"
+          pipx install "black==${BLACK_VERSION}"
+      - name: Show versions
+        run: |
+          shfmt --version
+          black --version
+          shellcheck --version
+      - name: Check formatting
+        run: ./hack/code/format.sh --check

hack/build/activate-env.sh

@@ -10,6 +10,7 @@ activate_env() {
 		python3 -m venv venv
 		pip install --upgrade pip
 	fi
+	# shellcheck source=/dev/null # venv is created at runtime, not present at lint time
 	. venv/bin/activate
 	pip3 install -qq -r requirements.txt
 }

hack/build/build.sh

@@ -36,27 +36,27 @@ SQUASH_SIZE=$(stat -c %s "${ADDONS_SQUASHFS_PATH}")
 
 # Host kernel size matters less, but we still don't want it to massively balloon all of a sudden.
 case "$KERNEL_FLAVOR" in
-    host*)
-        if [ "${SQUASH_SIZE}" -gt 419430400 ]; then
-            echo "ERROR: squashfs is >400MB in size (${SQUASH_SIZE} bytes) which is undesirable for the 'host' kernel, validate kconfig options!" >&2
-            exit 1
-        fi
-        ;;
+host*)
+	if [ "${SQUASH_SIZE}" -gt 419430400 ]; then
+		echo "ERROR: squashfs is >400MB in size (${SQUASH_SIZE} bytes) which is undesirable for the 'host' kernel, validate kconfig options!" >&2
+		exit 1
+	fi
+	;;
 esac
 
 # Generally we want to keep zone kernels small, because large kernels -> longer pull times -> increased zone cold boot times.
 # We don't really care how big the host kernel is.
 # Nvidia kernels have chonker firmwares, even compressed (like 200MB total size), so not much we can really do there.
 case "$KERNEL_FLAVOR" in
-    zone-nvidiagpu)
-        # Firmware means this is unavoidably quite large
-        ;;
-    zone*)
-        if [ "${SQUASH_SIZE}" -gt 52428800 ]; then
-            echo "ERROR: squashfs is >50MB in size (${SQUASH_SIZE} bytes) which is undesirable for the 'zone' kernel, validate kconfig options!" >&2
-            exit 1
-        fi
-        ;;
+zone-nvidiagpu)
+	# Firmware means this is unavoidably quite large
+	;;
+zone*)
+	if [ "${SQUASH_SIZE}" -gt 52428800 ]; then
+		echo "ERROR: squashfs is >50MB in size (${SQUASH_SIZE} bytes) which is undesirable for the 'zone' kernel, validate kconfig options!" >&2
+		exit 1
+	fi
+	;;
 esac
 
 if [ "${TARGET_ARCH_STANDARD}" = "x86_64" ]; then

hack/build/common.sh

@@ -98,23 +98,23 @@ KERNEL_ARCH_STANDARD=$TARGET_ARCH_STANDARD
 
 # HACK: kconfig paths use different arch keywords, so we have to get cute and munge
 case "${TARGET_ARCH_STANDARD}" in
-	x86_64)
-		KERNEL_ARCH_STANDARD="x86"
-		;;
-	aarch64)
-		KERNEL_ARCH_STANDARD="arm64"
-		;;
-	*)
-		KERNEL_ARCH_STANDARD="${TARGET_ARCH_STANDARD}"
-		;;
+x86_64)
+	KERNEL_ARCH_STANDARD="x86"
+	;;
+aarch64)
+	KERNEL_ARCH_STANDARD="arm64"
+	;;
+*)
+	KERNEL_ARCH_STANDARD="${TARGET_ARCH_STANDARD}"
+	;;
 esac
 
 KCONFIG_FRAGMENT_DEST="${KERNEL_SRC}/arch/${KERNEL_ARCH_STANDARD}/configs/"
 
 # Copy out our custom kconfig - if we are building for a <flavor>-<variant>, merge the variant fragment with the flavor baseconfig
 # by copying the fragment into the kernel src tree and letting the kernel's `make` merge them
 case "${KERNEL_FLAVOR}" in
-  *-*)
+*-*)
 	# Looks like we are dealing with <flavor>-<variant>.config, versus <flavor>.config, so we have 2 fragments
 	FLAVOR=$(echo "${KERNEL_FLAVOR}" | cut -d'-' -f1)
 	VARIANT=$(echo "${KERNEL_FLAVOR}" | cut -d'-' -f2)
@@ -141,7 +141,7 @@ case "${KERNEL_FLAVOR}" in
 	# NOTE `make` craps the bed if you pass a leading space in front of the fragment here.
 	MAKE_CONFIG_FRAGMENTS="${FLAVOR}.config ${FLAVOR}-${VARIANT}.fragment.config"
 	;;
-  *)
+*)
 	# Looks like we are dealing with just one <flavor>.config fragment
 	BASE_FLAVOR_CONFIG="${KERNEL_DIR}/configs/${TARGET_ARCH_STANDARD}/${KERNEL_FLAVOR}.config"
 

hack/build/firmware.sh

@@ -28,12 +28,14 @@ if [ -n "${FIRMWARE_SIG_URL}" ]; then
 	unxz "$FIRMWARE_URL"
 	# We've uncompressed it, update the env var so later stuff points at the right file
 	FIRMWARE_URL="${FIRMWARE_URL%.xz}"
-	gpg --verify "$FIRMWARE_SIG_URL" || { echo "ERROR: signature ${FIRMWARE_SIG_URL} cannot validate ${FIRMWARE_URL}"; exit 1; }
+	gpg --verify "$FIRMWARE_SIG_URL" || {
+		echo "ERROR: signature ${FIRMWARE_SIG_URL} cannot validate ${FIRMWARE_URL}"
+		exit 1
+	}
 else
 	echo "No firmware signature defined, no validation will be performed"
 fi
 
-
 # Note that this assumes the archive is a .tar file, and has already been validated elsewhere.
 if [ -n "${FIRMWARE_URL}" ]; then
 	echo "untarring firmware at $FIRMWARE_URL"
@@ -102,11 +104,11 @@ if [ "${KERNEL_FLAVOR}" = "zone-nvidiagpu" ] && [ "${TARGET_ARCH_STANDARD}" = "x
 	create_links() {
 		local base_path="$1"
 		# create soname links
-		find "$base_path" -type f -name '*.so*' ! -path '*xorg/*' -print0 | while read -d $'\0' _lib; do
+		find "$base_path" -type f -name '*.so*' ! -path '*xorg/*' -print0 | while read -r -d $'\0' _lib; do
 			_soname=$(dirname "${_lib}")/$(readelf -d "${_lib}" | grep -Po 'SONAME.*: \[\K[^]]*' || true)
-			_base=$(echo ${_soname} | sed -r 's/(.*)\.so.*/\1.so/')
-			[[ -e "${_soname}" ]] || ln -s $(basename "${_lib}") "${_soname}"
-			[[ -e "${_base}" ]] || ln -s $(basename "${_soname}") "${_base}"
+			_base=$(echo "${_soname}" | sed -r 's/(.*)\.so.*/\1.so/')
+			[[ -e "${_soname}" ]] || ln -s "$(basename "${_lib}")" "${_soname}"
+			[[ -e "${_base}" ]] || ln -s "$(basename "${_soname}")" "${_base}"
 		done
 	}
 
@@ -125,8 +127,8 @@ if [ "${KERNEL_FLAVOR}" = "zone-nvidiagpu" ] && [ "${TARGET_ARCH_STANDARD}" = "x
 			-mindepth 1 \
 			-path "./${triplet}/*" -prune -o \
 			-path "./${triplet}" -prune -o \
-			-type d -print0 \
-		| while IFS= read -r -d '' rel_dir; do
+			-type d -print0 |
+			while IFS= read -r -d '' rel_dir; do
 				# Strip leading "./"
 				rel_dir="${rel_dir#./}"
 				mkdir -p "${dst}/${rel_dir}"
@@ -156,8 +158,8 @@ if [ "${KERNEL_FLAVOR}" = "zone-nvidiagpu" ] && [ "${TARGET_ARCH_STANDARD}" = "x
 		find . \
 			-path "./${triplet}/*" -prune -o \
 			\( -type f -o -type l \) \
-			-print0 \
-		| while IFS= read -r -d '' rel_item; do
+			-print0 |
+			while IFS= read -r -d '' rel_item; do
 				rel_item="${rel_item#./}"
 				# Filter: only files and symlinks that resolve to files
 				if ! should_mirror "$rel_item"; then
@@ -190,15 +192,15 @@ if [ "${KERNEL_FLAVOR}" = "zone-nvidiagpu" ] && [ "${TARGET_ARCH_STANDARD}" = "x
 
 	# Wayland/GBM
 	mkdir -p "$WORKLOAD_OVERLAY_PATH/usr/lib/gbm"
-	ln -s ../libnvidia-allocator.so.$NV_VERSION "$WORKLOAD_OVERLAY_PATH/usr/lib/gbm/nvidia-drm_gbm.so"
+	ln -s "../libnvidia-allocator.so.${NV_VERSION}" "$WORKLOAD_OVERLAY_PATH/usr/lib/gbm/nvidia-drm_gbm.so"
 
 	# DRI driver
 	install -Dm755 "$NV_EXTRACT_PATH/out/"nvidia_drv.so "$WORKLOAD_OVERLAY_PATH/usr/lib/xorg/modules/drivers/nvidia_drv.so"
 
 	# GLX extensions
-	install -Dm755 "$NV_EXTRACT_PATH/out/"libglxserver_nvidia.so.$NV_VERSION "$WORKLOAD_OVERLAY_PATH/usr/lib/nvidia/xorg/libglxserver_nvidia.so.$NV_VERSION"
-	ln -s libglxserver_nvidia.so.$NV_VERSION "$WORKLOAD_OVERLAY_PATH/usr/lib/nvidia/xorg/libglxserver_nvidia.so.1"
-	ln -s libglxserver_nvidia.so.$NV_VERSION "$WORKLOAD_OVERLAY_PATH/usr/lib/nvidia/xorg/libglxserver_nvidia.so"
+	install -Dm755 "$NV_EXTRACT_PATH/out/libglxserver_nvidia.so.${NV_VERSION}" "$WORKLOAD_OVERLAY_PATH/usr/lib/nvidia/xorg/libglxserver_nvidia.so.${NV_VERSION}"
+	ln -s "libglxserver_nvidia.so.${NV_VERSION}" "$WORKLOAD_OVERLAY_PATH/usr/lib/nvidia/xorg/libglxserver_nvidia.so.1"
+	ln -s "libglxserver_nvidia.so.${NV_VERSION}" "$WORKLOAD_OVERLAY_PATH/usr/lib/nvidia/xorg/libglxserver_nvidia.so"
 
 	# Remove already-installed libs, so we don't accidentally include them in
 	# filters below
@@ -243,6 +245,7 @@ if [ "${KERNEL_FLAVOR}" = "zone-nvidiagpu" ] && [ "${TARGET_ARCH_STANDARD}" = "x
 
 	mkdir -p "$NVIDIA_BOOTSTRAP_OVERLAY_PATH"
 
+	# shellcheck disable=SC2043 # one entry today; loop mirrors the sibling install blocks
 	for BINARY in "$NV_EXTRACT_PATH/out/"nvidia-smi; do
 		BN="$(basename "$BINARY")"
 		install -Dm755 "$BINARY" "$NVIDIA_BOOTSTRAP_OVERLAY_PATH/usr/bin/$BN"
@@ -260,19 +263,19 @@ if [ "${KERNEL_FLAVOR}" = "zone-nvidiagpu" ] && [ "${TARGET_ARCH_STANDARD}" = "x
 	multiarch_symlink_mirror "$NVIDIA_BOOTSTRAP_OVERLAY_PATH" x86_64-linux-gnu
 
 	mkdir -p "$ADDONS_OUTPUT_PATH/hooks"
-	cat > "$ADDONS_OUTPUT_PATH/hooks/nvidia-persist.toml" <<-EOF
-[[hooks.setup]]
-overlay = "nvidia-bootstrap"
-modules = ["nvidia", "nvidia_drm", "nvidia_uvm"]
-execute = ["/usr/bin/nvidia-smi", "-pm", "1"]
-ignore-failure = true
-
-[[hooks.hotplug]]
-overlay = "nvidia-bootstrap"
-modules = ["nvidia", "nvidia_drm", "nvidia_uvm"]
-execute = ["/usr/bin/nvidia-smi", "-pm", "1"]
-ignore-failure = true
-EOF
+	cat >"$ADDONS_OUTPUT_PATH/hooks/nvidia-persist.toml" <<-EOF
+		[[hooks.setup]]
+		overlay = "nvidia-bootstrap"
+		modules = ["nvidia", "nvidia_drm", "nvidia_uvm"]
+		execute = ["/usr/bin/nvidia-smi", "-pm", "1"]
+		ignore-failure = true
+
+		[[hooks.hotplug]]
+		overlay = "nvidia-bootstrap"
+		modules = ["nvidia", "nvidia_drm", "nvidia_uvm"]
+		execute = ["/usr/bin/nvidia-smi", "-pm", "1"]
+		ignore-failure = true
+	EOF
 
 	cd "$OLDDIR"
 fi

hack/build/generate-clean-flavor-config.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 if [ $# -ne 4 ]; then
-		cat << EOF
+	cat <<EOF
 Usage: $(basename "$0") <kernel_version> <arch> <customized_flavor_config> <output_delta_flavor_config>
 
 Fetch an arch-specific kernel default configuration for a specific stable upstream kernel version and compare it
@@ -24,7 +24,7 @@ Notes:
 		- Only lines that were added or changed in <edera_flavor_config> are saved
 		- <output_file> must end in '.config' or kernel make will complain.
 EOF
-		exit 1
+	exit 1
 fi
 
 UPSTREAM_KVER="$1"
@@ -40,47 +40,47 @@ KERNEL_URL="https://cdn.kernel.org/pub/linux/kernel/v$(echo "$UPSTREAM_KVER" | c
 TARBALL_PATH="$TEMP_DIR/linux-${UPSTREAM_KVER}.tar.xz"
 
 if [ ! -f "$FULL_EDERA_FLAVOR_CONFIG" ]; then
-		echo "Error: Complete Edera kernel config file does not exist at $FULL_EDERA_FLAVOR_CONFIG!"
-		exit 1
+	echo "Error: Complete Edera kernel config file does not exist at $FULL_EDERA_FLAVOR_CONFIG!"
+	exit 1
 fi
 
 echo "Fetching kernel.org stable kernel default config for version $UPSTREAM_KVER (arch: $ARCH)..."
 
 # Map architecture names to kernel arch names and config paths
 case "$ARCH" in
-		x86_64)
-				CONFIG_SNIP="arch/x86/configs/x86_64_defconfig"
-				;;
-		arm64|aarch64)
-				CONFIG_SNIP="arch/arm64/configs/defconfig"
-				;;
-		*)
-				echo "Error: Unsupported architecture: $ARCH"
-				exit 1
-				;;
+x86_64)
+	CONFIG_SNIP="arch/x86/configs/x86_64_defconfig"
+	;;
+arm64 | aarch64)
+	CONFIG_SNIP="arch/arm64/configs/defconfig"
+	;;
+*)
+	echo "Error: Unsupported architecture: $ARCH"
+	exit 1
+	;;
 esac
 
 # Extract only the config file we need
 mkdir -p "$TEMP_DIR/linux"
 echo "Downloading released kernel $UPSTREAM_KVER from $KERNEL_URL to $TARBALL_PATH"
 if ! curl -sSL "$KERNEL_URL" -o "$TARBALL_PATH"; then
-		echo "Error: Failed to download kernel version $UPSTREAM_KVER."
-		exit 1
+	echo "Error: Failed to download kernel version $UPSTREAM_KVER."
+	exit 1
 fi
 
 if ! tar -xf "$TARBALL_PATH" --strip-components=1 -C "$TEMP_DIR/linux" "linux-${UPSTREAM_KVER}/$CONFIG_SNIP"; then
-		echo "Error: Failed to extract config file from the tarball."
-		exit 1
+	echo "Error: Failed to extract config file from the tarball."
+	exit 1
 fi
 
 CONFIG_PATH="$TEMP_DIR/linux/$CONFIG_SNIP"
 
 if [ -f "$CONFIG_PATH" ]; then
-		echo "Generating a trimmed delta flavor config between kernel $UPSTREAM_KVER default config for $ARCH and flavor config $FULL_EDERA_FLAVOR_CONFIG"
+	echo "Generating a trimmed delta flavor config between kernel $UPSTREAM_KVER default config for $ARCH and flavor config $FULL_EDERA_FLAVOR_CONFIG"
 	./hack/build/generate-kfragment.sh "$CONFIG_PATH" "$FULL_EDERA_FLAVOR_CONFIG" "$DELTA_EDERA_FLAVOR_CONFIG"
 else
-		echo "Error: Config file not found at $CONFIG_PATH"
-		exit 1
+	echo "Error: Config file not found at $CONFIG_PATH"
+	exit 1
 fi
 
 echo "trimmed flavor delta config saved to $DELTA_EDERA_FLAVOR_CONFIG"

hack/build/generate-clean-variant-config.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 if [ $# -ne 5 ]; then
-		cat << EOF
+	cat <<EOF
 Usage: $(basename "$0") <edera_base_flavor> <edera_flavor_kver> <arch> <customized_variant_config> <output_delta_variant_config>
 
 Fetch an arch-specific Edera base flavor kernel configuration and compare it with another (local) config,
@@ -23,7 +23,7 @@ Notes:
 		- Only lines that were added or changed in <customized_variant_config> are saved in <output_delta_variant_config>
 		- <output_delta_variant_config> must end in '.config' or kernel make will complain.
 EOF
-		exit 1
+	exit 1
 fi
 
 FLAVOR="$1"
@@ -40,20 +40,20 @@ trap 'rm -rf "$TEMP_DIR"; echo "Cleaning up temporary files..."; exit' INT TERM
 crane export "ghcr.io/edera-dev/$FLAVOR-kernel:$VERSION" - --platform=linux/"$ARCH" | tar --keep-directory-symlink -xf - -C "$TEMP_DIR"
 
 if [ ! -f "$TEMP_DIR/kernel/config.gz" ]; then
-		echo "Error: Exported Edera flavor config file does not exist at $TEMP_DIR/kernel/config.gz!"
-		exit 1
+	echo "Error: Exported Edera flavor config file does not exist at $TEMP_DIR/kernel/config.gz!"
+	exit 1
 fi
 
 gunzip "$TEMP_DIR/kernel/config.gz"
 
 EXTRACTED_CONFIG="$TEMP_DIR/kernel/config"
 
 if [ -f "$EXTRACTED_CONFIG" ]; then
-		echo "Generating a trimmed delta variant config between latest edera $FLAVOR kernel config for $ARCH and $CUSTOMIZED_VARIANT_CONFIG"
+	echo "Generating a trimmed delta variant config between latest edera $FLAVOR kernel config for $ARCH and $CUSTOMIZED_VARIANT_CONFIG"
 	./hack/build/generate-kfragment.sh "$EXTRACTED_CONFIG" "$CUSTOMIZED_VARIANT_CONFIG" "$DELTA_VARIANT_CONFIG"
 else
-		echo "Error: Config file not found at $EXTRACTED_CONFIG"
-		exit 1
+	echo "Error: Config file not found at $EXTRACTED_CONFIG"
+	exit 1
 fi
 
 echo "trimmed delta variant config saved to $DELTA_VARIANT_CONFIG"