- hooks/pre-push: bash -n + shellcheck -S warning -e SC1090 on every
tracked *.sh; fails closed when shellcheck is missing, bypassable with
--no-verify; enable with 'git config core.hooksPath hooks' (documented)
- tests/smoke.sh: manual docker/podman Arch-container run of bat.sh,
zsh.sh and fish.sh with assertions (idempotent bat config, timestamped
zsh backups, fisher actually installed in fish); LazyVim.sh opt-in.
This catches the inverted-condition/quoting class shellcheck cannot.
fish.sh gains a SKIP_END4_SETUP=1 test hook to skip end-4's installer
- README: scripts table (documents installbeta.sh vs install.sh and why
SecureBoot.sh is not in the menu), apt full-upgrade note, development
section; claims audited against current behavior (gum wording already
correct, no whiptail/selection claims remain)
- remove untracked vendored gum.md (reference only, per decision)
- timestamped .zshrc backups (was: .zshrc.bak overwritten every run, so
only the latest pre-run state survived)
- only remove ~/.oh-my-zsh when it actually contains oh-my-zsh.sh; warn
and leave anything else alone (was: unguarded rm -rf)
- add --needed to the pacman prerequisite install
- drop the empty ~/.fzf/shell/key-bindings.zsh placeholder (nothing
sourced it; fzf integration comes from the oh-my-zsh plugin)
- LICENSE spelling in banners (zsh.sh, installbeta.sh)
- print a 'log out and back in' notice after usermod -aG docker (both
fresh-install and already-installed branches; previously missing)
- remove the unexplained sleep 10 in the already-installed docker branch
- remove 'echo "+ sleep 10" && sleep 10' fake-command lines in failure
branches (record_failure already reports the failure)
- affinity keeps its 10s read-the-instructions delay but announces it
honestly instead of echoing a fake '+ 10 sleep' command
- set -Eeuo pipefail at the top (was only enabled after the menu, so
package installs and shelly bootstrap ran unchecked); preamble audited
for guarded vs unguarded commands ([ -t 1 ] && ... became an if, clear
is now 'clear || true')
- error_handler now reports exit status, line number and the failing
command, and the ERR trap is installed after strict mode so preamble
failures abort instead of printing a message and continuing
- exit 1 when any step was recorded as failed (was: always exit 0)
- single STAMP shared by LOG and REPORT; both created via mktemp
(predictable /tmp log names + tee -a was the same symlink class)
- local script/config fallbacks resolved via BASH_SOURCE (SCRIPT_DIR),
not the caller's CWD; falls back to remote fetch when piped
- $? captured via rc=$? inside each failure branch (idempotent under
reordering) for all record_failure call sites
- ${1:-} for the flag check, ${SHELL:-} in the fish detection,
tty-guarded fish warning prompt
- mktemp -d workspace (trap-cleaned) for the shelly AUR clone, shelly toml
downloads, docker installer and affinity script - no more predictable
/tmp/shelly_install, /tmp/shelly-standard.toml, /tmp/shelly-aur.toml
- download get.docker.sh and AffinityLinuxInstaller.py with curl -fsSL to a
file instead of piping to sh/python3 (the python pipe was missing -f, so an
HTTP 404 body was executed as Python)
- plain numbered menu fallback when gum is unavailable (Fedora has neither
shelly nor apt, so gum was never installed and 'gum choose' failed with a
misleading 'User cancelled installation.')
- $? capture via rc=$? inside the failure branch (safe under reordering)
- swap the crossed branch tests (fish branch checked ~/.bashrc, bash branch
checked ~/.config/fish/config.fish - each never matched its shell)
- install fisher/nvm.fish via 'fish -c' instead of calling fisher from bash
- timestamped backups (nvim.bak-YYYYmmdd-HHMMSS) instead of rm -rf of all
*.bak dirs first - a re-run no longer destroys the original backup
- check git clone result and point at the preserved backup on failure
- load nvm by sourcing its init script (nvm is a function; 'command -v nvm'
never succeeded, so the whole block was dead code)
- guard nvm init sourcing under set +u, fall back to system nodejs
- idempotent rc appends (grep guard), tty-guarded Ctrl+C grace period
- set -euo pipefail with guarded/unguarded audit
- typos: prerequisites, secconds
- prerequisite condition tested fish (was inverted: 'zsh missing and
git/curl/fzf present', so fish was never installed on a working machine)
- run fisher bootstrap inside fish via 'fish -c' (was: 'curl | source' in
bash, which always failed with 'filename argument required')
- download fisher.fish with curl -fsSL to a temp file first (fail on HTTP error)
- resolve configs/ via BASH_SOURCE; when piped (curl | bash) fall back to
the end-4 clone instead of failing on relative paths from an arbitrary CWD
- clone dots-hyprland into mktemp -d, never into the caller's CWD; git -C
style usage so a failed pull can't strand the script's working directory
- set -euo pipefail from the top with a guarded/unguarded audit
- warn visibly that end-4 still runs with --force --skip-backup (kept per decision)
- mkdir -p before config copies; tty-guarded fish warning; ${1:-}
- set -euo pipefail with audit: every tolerated failure is guarded
- write --theme to bat's config file, not into the themes/ directory (was: append to a directory, failed silently)
- download and configure the same theme (Catppuccin Mocha; was: Macchiato downloaded, Mocha configured)
- preserve MANPAGER quoting via printf (was: collapsed to export MANPAGER=bat -plman, invalid when sourced)
- detect shell via $SHELL instead of $0 (was: always matched *) and reported 'Unsupported shell: bat.sh')
- fish branch appends fish syntax, no more exec of a mangled command string
- check pacman/apt bat install results (was: unchecked, continued on failure)
- idempotent appends (grep guard), tty-guarded fish warning
- remove broken rc-sourcing block (sourced .zshrc/config.fish from bash)
- set -euo pipefail and fix pacman --noconfirm typo (was -noconfirm)
- abort on non-UEFI systems (/sys/firmware/efi check)
- verify sbctl installed and sign targets exist before touching keys
- fix x84_64-efi typo, skip missing targets instead of failing silently
- require sbctl verify to pass before offering enrollment
- prompt y/N before enroll-keys with BIOS/USB recovery guidance
- gate success message on final sbctl verify, non-zero exit on failure
alvinlollo
