v1.1.2

tests/full-verify.sh

@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 set -euo pipefail
 ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
-"$ROOT/tests/verify.sh"
+bash "$ROOT/tests/verify.sh"
+bash "$ROOT/tests/mode-independence.sh"
 (cd "$ROOT/backend" && go test -race ./...)
-"$ROOT/backend/integration-test.sh"
-"$ROOT/tests/gitea-release-helper.sh"
-"$ROOT/tests/package-verify.sh"
+bash "$ROOT/backend/integration-test.sh"
+bash "$ROOT/tests/gitea-release-helper.sh"
+bash "$ROOT/tests/package-verify.sh"
 echo 'Citizen Launcher full verification: OK'

tests/gitea-release-helper.sh

@@ -25,7 +25,7 @@ class H(http.server.BaseHTTPRequestHandler):
         return r
     def do_GET(self):
         path=urllib.parse.urlparse(self.path).path
-        if path.endswith('/releases/tags/v1.1.1'):
+        if path.endswith('/releases/tags/v1.1.2'):
             if release is None: self.send_error(404); return
             self.sendj(200,self.rel()); return
         if path.startswith('/download/'):
@@ -78,12 +78,12 @@ export GITEA_API_URL="http://127.0.0.1:${PORT}/api/v1"
 export GITEA_REPOSITORY="owner/repo"
 export GITEA_TOKEN="test-token"
 
-echo first > "$TMP/citizen-launcher_1.1.1_amd64.deb"
-"$ROOT/scripts/gitea-release.sh" ensure v1.1.1 'Citizen Launcher 1.1.1' "$ROOT/RELEASE_NOTES.md" deadbeef
-"$ROOT/scripts/gitea-release.sh" ensure v1.1.1 'Citizen Launcher 1.1.1' "$ROOT/RELEASE_NOTES.md" deadbeef
-"$ROOT/scripts/gitea-release.sh" upload v1.1.1 "$TMP/citizen-launcher_1.1.1_amd64.deb"
-echo replacement > "$TMP/citizen-launcher_1.1.1_amd64.deb"
-"$ROOT/scripts/gitea-release.sh" upload v1.1.1 "$TMP/citizen-launcher_1.1.1_amd64.deb"
-"$ROOT/scripts/gitea-release.sh" download-assets v1.1.1 "$TMP/download"
-cmp "$TMP/citizen-launcher_1.1.1_amd64.deb" "$TMP/download/citizen-launcher_1.1.1_amd64.deb"
+echo first > "$TMP/citizen-launcher_1.1.2_amd64.deb"
+bash "$ROOT/scripts/gitea-release.sh" ensure v1.1.2 'Citizen Launcher 1.1.2' "$ROOT/RELEASE_NOTES.md" deadbeef
+bash "$ROOT/scripts/gitea-release.sh" ensure v1.1.2 'Citizen Launcher 1.1.2' "$ROOT/RELEASE_NOTES.md" deadbeef
+bash "$ROOT/scripts/gitea-release.sh" upload v1.1.2 "$TMP/citizen-launcher_1.1.2_amd64.deb"
+echo replacement > "$TMP/citizen-launcher_1.1.2_amd64.deb"
+bash "$ROOT/scripts/gitea-release.sh" upload v1.1.2 "$TMP/citizen-launcher_1.1.2_amd64.deb"
+bash "$ROOT/scripts/gitea-release.sh" download-assets v1.1.2 "$TMP/download"
+cmp "$TMP/citizen-launcher_1.1.2_amd64.deb" "$TMP/download/citizen-launcher_1.1.2_amd64.deb"
 echo 'Gitea release helper verification: OK'

tests/mode-independence.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+
+python3 - "$ROOT" <<'PY'
+from pathlib import Path
+import re, sys
+root = Path(sys.argv[1])
+check = [
+    root/'build.sh', root/'install-omarchy.sh', root/'INSTALLIEREN.sh',
+    root/'tests/full-verify.sh', root/'tests/verify.sh', root/'tests/package-verify.sh',
+    root/'tests/gitea-release-helper.sh', root/'packaging/build-all.sh',
+    root/'.gitea/workflows/ci.yml', root/'.gitea/workflows/release.yml',
+]
+for p in check:
+    text = p.read_text()
+    bad = []
+    for lineno, line in enumerate(text.splitlines(), 1):
+        stripped = line.strip()
+        if stripped.startswith('#') or stripped.endswith('\\') or stripped.endswith('; do'):
+            continue
+        # Direct ./script.sh command (workflow or shell command) without an interpreter.
+        if re.search(r'(^|[;&|]\s*|run:\s*)\./[^\s"\x27]+\.sh(?:\s|$)', stripped):
+            bad.append((lineno, stripped))
+        # Direct "$ROOT/path/script.sh" command at start of a shell line.
+        if re.search(r'^"?\$ROOT/[^"\s]+\.sh"?(?:\s|$)', stripped):
+            bad.append((lineno, stripped))
+    if bad:
+        raise SystemExit(f'direct shell execution remains in {p}: {bad}')
+print('Mode-independent shell invocation: OK')
+PY

tests/package-verify.sh

@@ -4,8 +4,8 @@ ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
 VERSION="$(tr -d '[:space:]' < "$ROOT/VERSION")"
 rm -rf "$ROOT/dist"
 mkdir -p "$ROOT/dist"
-"$ROOT/packaging/build-deb.sh"
-"$ROOT/packaging/build-tarball.sh"
+bash "$ROOT/packaging/build-deb.sh"
+bash "$ROOT/packaging/build-tarball.sh"
 DEB="$ROOT/dist/citizen-launcher_${VERSION}_amd64.deb"
 TAR="$ROOT/dist/citizen-launcher-${VERSION}-linux-amd64.tar.gz"
 [[ -s "$DEB" && -s "$TAR" ]]
@@ -45,14 +45,14 @@ grep -q "'x86_64'" "$ROOT/packaging/arch/PKGBUILD.in"
 grep -q 'citizen-launcher-self-update.timer' "$ROOT/packaging/arch/PKGBUILD.in"
 
 if command -v rpmbuild >/dev/null 2>&1; then
-  "$ROOT/packaging/build-rpm.sh"
+  bash "$ROOT/packaging/build-rpm.sh"
   RPM="$ROOT/dist/citizen-launcher-${VERSION}-1.linux.x86_64.rpm"
   [[ -s "$RPM" ]]
   rpm -qp --qf '%{NAME}\n%{VERSION}\n%{ARCH}\n' "$RPM" | grep -qx 'citizen-launcher' -m1
 fi
 
 if command -v makepkg >/dev/null 2>&1 && [[ $EUID -ne 0 ]]; then
-  "$ROOT/packaging/build-arch.sh"
+  bash "$ROOT/packaging/build-arch.sh"
   [[ -s "$ROOT/dist/citizen-launcher-${VERSION}-1-x86_64.pkg.tar.zst" ]]
 fi
 

tests/verify.sh

@@ -5,11 +5,11 @@ for f in \
   "$ROOT/install.sh" "$ROOT/uninstall.sh" "$ROOT/install-omarchy.sh" "$ROOT/INSTALLIEREN.sh" \
   "$ROOT/build.sh" "$ROOT/packaging/build-deb.sh" "$ROOT/packaging/build-rpm.sh" \
   "$ROOT/packaging/build-arch.sh" "$ROOT/packaging/build-tarball.sh" "$ROOT/packaging/build-all.sh" \
-  "$ROOT/scripts/gitea-release.sh" "$ROOT/tests/gitea-release-helper.sh"; do
+  "$ROOT/scripts/gitea-release.sh" "$ROOT/tests/gitea-release-helper.sh" "$ROOT/tests/mode-independence.sh"; do
   bash -n "$f"
 done
 (cd "$ROOT/backend" && gofmt -w cmd/citizen-launcher && go test ./... && go vet ./...)
-"$ROOT/build.sh"
+bash "$ROOT/build.sh"
 [[ "$("$ROOT/backend/bin/citizen-launcher" --version)" == "$(tr -d '[:space:]' < "$ROOT/VERSION")" ]]
 [[ ! -n "$(gofmt -l "$ROOT/backend/cmd/citizen-launcher")" ]]
 python3 - <<'PY' "$ROOT"
@@ -22,6 +22,12 @@ release=(root/'.gitea/workflows/release.yml').read_text()
 assert 'gh release' not in release
 assert 'gitea.api_url' in release and 'gitea.token' in release
 assert 'actions/upload-artifact' not in release and 'actions/download-artifact' not in release
+
+import re
+for wf in [root/'.gitea/workflows/ci.yml', root/'.gitea/workflows/release.yml']:
+    text=wf.read_text()
+    bad=re.findall(r'(?m)^\s*(?:run:\s*)?(\./[^\s]+\.sh)(?:\s|$)', text)
+    assert not bad, f'workflow executes shell script directly: {wf}: {bad}'
 print('Gitea workflow yaml: OK')
 PY
 echo 'Citizen Launcher verification: OK'