fix: Made shellcheck clean, and install jv so the schema test runs

shellcheck findings, all real:

- spdx-headers.sh listed */init.test.sys_class_net/* beside *.test.*,
  which already matches it - those fixture paths contain ".test." too.
- init.sh masked the return value of $(cat) behind 'local'.
- SLOT is genuinely unused in three install-kernel-* scripts, while
  grub and uboot use it. Kept and annotated: every install-kernel-*
  takes the slot as its first argument and the callers pass it.
- The two busybox scripts are ash; told shellcheck to read them as dash.

The Bash suite failed on 'jv: command not found'. The test's own apk/apt
fallback needs root, which the runner is not, and jsonschema-jv is not a
Debian package - so CI installs the pinned release binary instead.

Both jobs stay continue-on-error until one run proves them green.

Signed-off-by: Simon Walz <contact@simonwalz.de>

Author: simonwalz

.github/scripts/spdx-headers.sh

@@ -95,9 +95,10 @@ in_scope() {
     *.test.sh) return 0 ;;
   esac
   # Test fixtures: never touch, whatever the extension. A header could change
-  # what a test compares.
+  # what a test compares. This also covers the fixture directories, whose paths
+  # contain ".test." as well - init.test.sys_class_net/eth0/address and the like.
   case "${file}" in
-    *.test.*|*/init.test.sys_class_net/*) return 1 ;;
+    *.test.*) return 1 ;;
   esac
 
   case "${file}" in

.github/workflows/ci.yml

@@ -92,14 +92,28 @@ jobs:
   tests:
     name: Bash test suite
     runs-on: ubuntu-latest
-    # Not yet a gate: two suites fail on missing tools (yq mikefarah v4, jv),
-    # not on defects — see brain/tasks/fix-failing-tests.md. Remove this line
-    # once those are installed here or the tests skip cleanly.
+    # Not yet a gate. jv is installed below, so the schema suite runs; leave
+    # this until one run has proven that green, then remove it.
+    # See brain/tasks/fix-failing-tests.md.
     continue-on-error: true
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
 
+      # system-schema.test.sh and system/cuos/init.sh validate system.json with
+      # jv. It is not on the runner, and the script's own apk/apt fallback needs
+      # root, which the runner is not. Pinned rather than "latest": a validator
+      # that changes under us turns a green suite red for no reason.
+      - name: Install jv
+        shell: bash
+        env:
+          JV_VERSION: v6.0.3
+        run: |
+          set -euo pipefail
+          url="https://github.com/santhosh-tekuri/jsonschema/releases/download/${JV_VERSION}/jv-${JV_VERSION}-linux-amd64.tar.gz"
+          curl -fsSL "${url}" | sudo tar -xz -C /usr/local/bin jv
+          jv --version
+
       - name: Run every *.test.sh
         shell: bash
         run: |

system/cuos/init.sh

@@ -233,7 +233,8 @@ configure_network_interface() {
   local iface="$1"
   local network_interface_id="$2"
 
-  local config="$(cat)"
+  local config
+  config="$(cat)"
   local dhcp
   dhcp=$(echo "$config" | jq -r '.dhcp // empty')
   local ip

system/cuos/install-kernel-rpi-rollback.sh

@@ -8,6 +8,8 @@ source "${SCRIPT_DIR}/utils.sh"
 
 set -x
 
+# shellcheck disable=SC2034  # unused here, but every install-kernel-* takes the
+# slot as its first argument and the callers pass it uniformly.
 SLOT="$1"
 # from exports:
 # TARGET_BOOT

system/cuos/install-kernel-rpi.sh

@@ -8,6 +8,8 @@ source "${SCRIPT_DIR}/utils.sh"
 
 set -x
 
+# shellcheck disable=SC2034  # unused here, but every install-kernel-* takes the
+# slot as its first argument and the callers pass it uniformly.
 SLOT="$1"
 # from exports:
 # TARGET_BOOT

system/cuos/install-kernel-uboot-rollback.sh

@@ -8,6 +8,8 @@ source "${SCRIPT_DIR}/utils.sh"
 
 set -x
 
+# shellcheck disable=SC2034  # unused here, but every install-kernel-* takes the
+# slot as its first argument and the callers pass it uniformly.
 SLOT="$1"
 # from exports:
 # TARGET_BOOT

system/cuos/lxc-swaproot/swap_rollback.sh

@@ -1,5 +1,6 @@
 #!/swaproot/busybox sh
 # SPDX-License-Identifier: Apache-2.0
+# shellcheck shell=dash  # busybox ash; dash is the closest dialect shellcheck knows
 
 dirs="bin boot etc home lib lib64 media mnt opt root run sbin srv tmp usr var system.json system_next.json"
 # shellcheck disable=SC2123

system/cuos/lxc-swaproot/swap_update.sh

@@ -1,5 +1,6 @@
 #!/swaproot/busybox sh
 # SPDX-License-Identifier: Apache-2.0
+# shellcheck shell=dash  # busybox ash; dash is the closest dialect shellcheck knows
 
 dirs="bin boot etc home lib lib64 media mnt opt root run sbin srv tmp usr var system.json system_next.json"
 # shellcheck disable=SC2123