From 055d8a96200c54df55c5d11a089eb0270b7b6f21 Mon Sep 17 00:00:00 2001
From: Mathias Scheider <mathias2784@web.de>
Date: Sat, 5 Sep 2026 21:40:41 +0200
Subject: [PATCH] fix some test findings

---
 _install_skripte/nextcloud.sh             |  3 ++-
 term/.config/tmux/layouts/demo.session.sh |  1 +
 test/Dockerfile                           | 14 +++++++++-----
 test/lint.sh                              | 17 ++++++++++++-----
 test/probe_stow.sh                        |  2 +-
 5 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/_install_skripte/nextcloud.sh b/_install_skripte/nextcloud.sh
index 0584c01..9dbbe80 100755
--- a/_install_skripte/nextcloud.sh
+++ b/_install_skripte/nextcloud.sh
@@ -1,8 +1,9 @@
+#!/bin/bash
 
 retry() {
     local N=$1; shift
     local t=$2; shift
-    for i in $(seq 1 $N); do
+    for _ in $(seq 1 $N); do
         "$@" && return 0 || sleep $t
     done
     return 1
diff --git a/term/.config/tmux/layouts/demo.session.sh b/term/.config/tmux/layouts/demo.session.sh
index 3e959ba..948473d 100644
--- a/term/.config/tmux/layouts/demo.session.sh
+++ b/term/.config/tmux/layouts/demo.session.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Example session: demo
 # Usage: tmuxifier load-session demo
 # Edit:  tmuxifier edit-session demo
diff --git a/test/Dockerfile b/test/Dockerfile
index 6fd8172..1015bf4 100644
--- a/test/Dockerfile
+++ b/test/Dockerfile
@@ -39,8 +39,12 @@ RUN useradd -m -u "$UID_ARG" -s /bin/bash -G wheel "$USERNAME"
 RUN printf '%%wheel ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/wheel-nopasswd \
     && chmod 440 /etc/sudoers.d/wheel-nopasswd
 
-USER "$USERNAME"
-ENV HOME="/home/$USERNAME"
+# Use a literal (not the ARG) for USER/ENV: the legacy builder can silently
+# ignore a `USER "$ARG"` when the variable resolves after a stage boundary,
+# leaving the container running as root (which breaks git ownership checks on
+# the mounted host-owned repo). The value is fixed at mathias by default anyway.
+USER mathias
+ENV HOME="/home/mathias"
 WORKDIR /dotfiles
 
 # ---------------------------------------------------------------------------
@@ -51,10 +55,10 @@ FROM base AS dev
 USER root
 RUN pacman -S --noconfirm --needed shellcheck
 
-USER "$USERNAME"
+USER mathias
 WORKDIR /dotfiles
 
-COPY --chown="$USERNAME" . /dotfiles
+COPY --chown=mathias . /dotfiles
 
 CMD ["bash", "test/lint.sh"]
 
@@ -65,7 +69,7 @@ CMD ["bash", "test/lint.sh"]
 # ---------------------------------------------------------------------------
 FROM base AS test
 
-USER "$USERNAME"
+USER mathias
 WORKDIR /dotfiles
 
 # The entrypoint drives the smoke tests. The repo is mounted at /dotfiles
diff --git a/test/lint.sh b/test/lint.sh
index 4a11bc0..f285ce1 100755
--- a/test/lint.sh
+++ b/test/lint.sh
@@ -11,8 +11,7 @@
 set -uo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-CD="$(pwd)"
-cd "$REPO_ROOT"
+cd "$REPO_ROOT" || exit 1
 
 PASS=0
 FAIL=0
@@ -25,11 +24,19 @@ say_pass() { printf 'ok:   %s\n' "$*"; PASS=$((PASS+1)); }
 #    Only repo-owned scripts; skip vendored tpm/ plugin shell scripts.
 #    Preferred source is git ls-files (the repo checkout); fall back to a
 #    filesystem scan when .git is not present (e.g. inside the docker dev
-#    image, where the repo is COPYied without .git).
+#    image, where the repo is COPYied without .git). Note: git ls-files can
+#    also silently return nothing when the mount has dubious ownership, so the
+#    fallback must stay robust by excluding vendored plugin trees ('*/plugins/').
 # ---------------------------------------------------------------------------
-mapfile -t SCRIPTS < <(git ls-files '*.sh' 2>/dev/null | grep -v '/tpm/' | grep -vE '/plugins/[^/]+/scripts/')
+# Exclusions: never lint tpm or general vendored plugin trees, whose third-party
+# scripts may legitimately fail `bash -n` and are not written/maintained here.
+EXCLUDE_VENDOR='(/tpm/|/plugins/|/plugins$)'
+mapfile -t SCRIPTS < <(git ls-files '*.sh' 2>/dev/null | grep -vE "$EXCLUDE_VENDOR")
 if [[ ${#SCRIPTS[@]} -eq 0 ]]; then
-    mapfile -t SCRIPTS < <(find . -name '*.sh' -not -path './.git/*' -not -path '*/tpm/*' -not -path '*/.git/*' | sort)
+    mapfile -t SCRIPTS < <(find . -name '*.sh' \
+        -not -path './.git/*' -not -path '*/.git/*' \
+        -not -path '*/tpm/*' -not -path '*/plugins/*' \
+        | sort)
 fi
 
 if [[ ${#SCRIPTS[@]} -eq 0 ]]; then
diff --git a/test/probe_stow.sh b/test/probe_stow.sh
index 3a8a00f..cc3c145 100755
--- a/test/probe_stow.sh
+++ b/test/probe_stow.sh
@@ -14,7 +14,7 @@
 set -uo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$REPO_ROOT"
+cd "$REPO_ROOT" || exit 1
 
 # A stow-able package is any tracked top-level directory that contains a
 # dot-prefixed config subtree (or a dot-prefixed top-level file/dir).