fix some test findings

_install_skripte/nextcloud.sh

@@ -1,8 +1,9 @@
+#!/bin/bash
 
 retry() {
     local N=$1; shift
     local t=$2; shift
-    for i in $(seq 1 $N); do
+    for _ in $(seq 1 $N); do
         "$@" && return 0 || sleep $t
     done
     return 1

term/.config/tmux/layouts/demo.session.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 # Example session: demo
 # Usage: tmuxifier load-session demo
 # Edit:  tmuxifier edit-session demo

test/Dockerfile

@@ -39,8 +39,12 @@ RUN useradd -m -u "$UID_ARG" -s /bin/bash -G wheel "$USERNAME"
 RUN printf '%%wheel ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/wheel-nopasswd \
     && chmod 440 /etc/sudoers.d/wheel-nopasswd
 
-USER "$USERNAME"
-ENV HOME="/home/$USERNAME"
+# Use a literal (not the ARG) for USER/ENV: the legacy builder can silently
+# ignore a `USER "$ARG"` when the variable resolves after a stage boundary,
+# leaving the container running as root (which breaks git ownership checks on
+# the mounted host-owned repo). The value is fixed at mathias by default anyway.
+USER mathias
+ENV HOME="/home/mathias"
 WORKDIR /dotfiles
 
 # ---------------------------------------------------------------------------
@@ -51,10 +55,10 @@ FROM base AS dev
 USER root
 RUN pacman -S --noconfirm --needed shellcheck
 
-USER "$USERNAME"
+USER mathias
 WORKDIR /dotfiles
 
-COPY --chown="$USERNAME" . /dotfiles
+COPY --chown=mathias . /dotfiles
 
 CMD ["bash", "test/lint.sh"]
 
@@ -65,7 +69,7 @@ CMD ["bash", "test/lint.sh"]
 # ---------------------------------------------------------------------------
 FROM base AS test
 
-USER "$USERNAME"
+USER mathias
 WORKDIR /dotfiles
 
 # The entrypoint drives the smoke tests. The repo is mounted at /dotfiles

test/lint.sh

@@ -11,8 +11,7 @@
 set -uo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-CD="$(pwd)"
-cd "$REPO_ROOT"
+cd "$REPO_ROOT" || exit 1
 
 PASS=0
 FAIL=0
@@ -25,11 +24,19 @@ say_pass() { printf 'ok:   %s\n' "$*"; PASS=$((PASS+1)); }
 #    Only repo-owned scripts; skip vendored tpm/ plugin shell scripts.
 #    Preferred source is git ls-files (the repo checkout); fall back to a
 #    filesystem scan when .git is not present (e.g. inside the docker dev
-#    image, where the repo is COPYied without .git).
+#    image, where the repo is COPYied without .git). Note: git ls-files can
+#    also silently return nothing when the mount has dubious ownership, so the
+#    fallback must stay robust by excluding vendored plugin trees ('*/plugins/').
 # ---------------------------------------------------------------------------
-mapfile -t SCRIPTS < <(git ls-files '*.sh' 2>/dev/null | grep -v '/tpm/' | grep -vE '/plugins/[^/]+/scripts/')
+# Exclusions: never lint tpm or general vendored plugin trees, whose third-party
+# scripts may legitimately fail `bash -n` and are not written/maintained here.
+EXCLUDE_VENDOR='(/tpm/|/plugins/|/plugins$)'
+mapfile -t SCRIPTS < <(git ls-files '*.sh' 2>/dev/null | grep -vE "$EXCLUDE_VENDOR")
 if [[ ${#SCRIPTS[@]} -eq 0 ]]; then
-    mapfile -t SCRIPTS < <(find . -name '*.sh' -not -path './.git/*' -not -path '*/tpm/*' -not -path '*/.git/*' | sort)
+    mapfile -t SCRIPTS < <(find . -name '*.sh' \
+        -not -path './.git/*' -not -path '*/.git/*' \
+        -not -path '*/tpm/*' -not -path '*/plugins/*' \
+        | sort)
 fi
 
 if [[ ${#SCRIPTS[@]} -eq 0 ]]; then

test/probe_stow.sh

@@ -14,7 +14,7 @@
 set -uo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$REPO_ROOT"
+cd "$REPO_ROOT" || exit 1
 
 # A stow-able package is any tracked top-level directory that contains a
 # dot-prefixed config subtree (or a dot-prefixed top-level file/dir).