From bccd1f551005121a6e3fd5912bf3eac0a52bdd9c Mon Sep 17 00:00:00 2001
From: Felitendo <felitendoyt@gmail.com>
Date: Fri, 25 Sep 2026 09:29:12 +0200
Subject: [PATCH] fix: fail make check on shellcheck findings

---
 Makefile          | 6 ++++--
 src/lib/config.sh | 1 +
 src/lib/menu.sh   | 4 ++--
 tests/test_pam.sh | 3 +++
 4 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index 2b7cda0..6fdc79b 100644
--- a/Makefile
+++ b/Makefile
@@ -119,13 +119,15 @@ else
 endif
 
 # Syntax-check every shell file, and run shellcheck when it is available.
+# SC2034 is off: the files share their variables, and shellcheck looks at one
+# file at a time.
 check:
 	@set -e; for f in src/face-unlock $(LIBS) tests/*.sh; do \
 		bash -n "$$f" && echo "ok  $$f"; \
 	done
 	@if command -v shellcheck >/dev/null 2>&1; then \
-		shellcheck -x -e SC1090,SC1091 src/face-unlock $(LIBS) tests/*.sh; \
-		echo "ok  shellcheck"; \
+		shellcheck -x -e SC1090,SC1091,SC2034 src/face-unlock $(LIBS) tests/*.sh \
+			&& echo "ok  shellcheck"; \
 	else \
 		echo "shellcheck not found, skipped"; \
 	fi
diff --git a/src/lib/config.sh b/src/lib/config.sh
index 6001070..3859bdb 100644
--- a/src/lib/config.sh
+++ b/src/lib/config.sh
@@ -65,6 +65,7 @@ fu_kv_set() {
 		{
 			printf '# %s\n' "$header"
 			printf '#\n'
+			# shellcheck disable=SC2016  # the backticks are text
 			printf '# Written by `%s`. Nothing here needs editing by hand:\n' "$FU_NAME"
 			printf '# every option is in the menu.\n'
 		} > "$file" || return 1
diff --git a/src/lib/menu.sh b/src/lib/menu.sh
index 5599581..0d96caa 100644
--- a/src/lib/menu.sh
+++ b/src/lib/menu.sh
@@ -421,11 +421,11 @@ _fu_camera_label() {
 
 # _fu_setting_change <scope> <Key> <type> <current> <choices> <step>
 _fu_setting_change() {
-	local scope="$1" key="$2" type="$3" current="$4" choices="$5" step="$6" next
+	local scope="$1" key="$2" type="$3" current="$4" options="$5" step="$6" next
 
 	case "$type" in
 		bool)   if fu_is_true "$current"; then next=no; else next=yes; fi ;;
-		choice) next="$(_fu_next_choice "$current" "$choices" "$step")" ;;
+		choice) next="$(_fu_next_choice "$current" "$options" "$step")" ;;
 		camera) next="$(_fu_next_camera "$current" "$step")" ;;
 	esac
 
diff --git a/tests/test_pam.sh b/tests/test_pam.sh
index a0d6eeb..efd23bd 100644
--- a/tests/test_pam.sh
+++ b/tests/test_pam.sh
@@ -11,6 +11,9 @@
 # also run through real PAM, with the module missing on purpose: the dash in
 # front of the line has to make PAM skip it without a word.
 
+# check() runs its second argument with eval, so that is quoted on purpose.
+# shellcheck disable=SC2016
+
 set -uo pipefail
 
 here="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"