fix ci error

Author: jeremyephron

home/dot_gitconfig.tmpl

@@ -37,6 +37,11 @@
 	st = status
 	graph = log --graph --decorate --oneline --all
 	root = rev-parse --show-toplevel
+[filter "lfs"]
+	smudge = git-lfs smudge -- %f
+	process = git-lfs filter-process
+	required = true
+	clean = git-lfs clean -- %f
 [includeIf "gitdir:~/src/personal/"]
 	path = ~/.gitconfig-personal
 [includeIf "gitdir:~/src/work/"]

tests/test-packages.sh

@@ -22,12 +22,15 @@ confirm() { return 0; }
 package_calls=''
 # shellcheck disable=SC2329
 run() { package_calls="${package_calls}|$*"; }
+# The real function is sourced above; ShellCheck only sees the test override below.
+# shellcheck disable=SC2218
 install_brewfile "${SOURCE_DIR}/packages/Brewfile.dev" >/dev/null 2>&1
 case "$package_calls" in
   *'|brew unlink bazel'*'|env HOMEBREW_NO_INSTALL_CLEANUP=1 brew bundle install --no-upgrade'*) ;;
   *) die 'Bazel was not unlinked before Brewfile installation continued.' ;;
 esac
 
+# shellcheck disable=SC2218
 install_brewfile "${SOURCE_DIR}/packages/Brewfile.infra" >/dev/null 2>&1
 case "$package_calls" in
   *'|brew trust --formula hashicorp/tap/terraform'*'|env HOMEBREW_NO_INSTALL_CLEANUP=1 brew bundle install --no-upgrade'*) ;;
@@ -46,6 +49,7 @@ run() {
     *) return 0 ;;
   esac
 }
+# shellcheck disable=SC2218
 MACHINE_SETUP_CI=1 install_brewfile "${SOURCE_DIR}/packages/Brewfile.core" >/dev/null 2>&1
 [ "$ci_bundle_attempts" -eq 2 ] || die 'CI did not retry a transient Homebrew bundle failure exactly once.'
 

tests/test-static.sh

@@ -23,7 +23,7 @@ grep -Fq 'nvim/mason/bin' "$SOURCE_DIR/scripts/doctor.sh"
 grep -Fq '/Applications/Utilities/XQuartz.app' "$SOURCE_DIR/scripts/doctor.sh"
 grep -Fq "nvim --headless '+Lazy! restore'" "$SOURCE_DIR/scripts/install-editor.sh"
 grep -Fq "mise exec -- nvim --headless '+Lazy! restore'" "$SOURCE_DIR/setup.sh"
-if rg -n "Lazy! sync" "$SOURCE_DIR/setup.sh" "$SOURCE_DIR/scripts"; then
+if grep -RFn 'Lazy! sync' "$SOURCE_DIR/setup.sh" "$SOURCE_DIR/scripts"; then
   printf 'Normal apply must not upgrade Neovim plugins.\n' >&2
   exit 1
 fi
@@ -55,7 +55,7 @@ fi
 
 git -C "$SOURCE_DIR" diff --check
 
-if rg -n --hidden --glob '!.git/**' --glob '!tests/**' \
+if grep -REn --exclude-dir=.git --exclude-dir=tests --binary-files=without-match \
   '(BEGIN (RSA|OPENSSH|EC|DSA) PRIVATE KEY|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{30,})' "$SOURCE_DIR"; then
   printf 'Potential secret material found.\n' >&2
   exit 1

tests/test-templates.sh

@@ -39,6 +39,10 @@ for profile in $MACHINE_SETUP_PROFILES; do
     [ -d "$test_home/src/$workspace" ] || die "${profile} did not create src/${workspace}."
   done
   [ "$(git config --file "$test_home/.gitconfig" --get user.useConfigOnly)" = true ] || die 'Git identity guard is missing.'
+  [ "$(git config --file "$test_home/.gitconfig" --get filter.lfs.smudge)" = 'git-lfs smudge -- %f' ] || die 'Git LFS smudge filter is missing.'
+  [ "$(git config --file "$test_home/.gitconfig" --get filter.lfs.process)" = 'git-lfs filter-process' ] || die 'Git LFS process filter is missing.'
+  [ "$(git config --file "$test_home/.gitconfig" --get filter.lfs.required)" = true ] || die 'Git LFS required guard is missing.'
+  [ "$(git config --file "$test_home/.gitconfig" --get filter.lfs.clean)" = 'git-lfs clean -- %f' ] || die 'Git LFS clean filter is missing.'
   expected_work_config="$home_token/.gitconfig-work"
   [ "$(git config --file "$test_home/.gitconfig" --get "includeIf.gitdir:~/src/${company_folder}/.path")" = "$expected_work_config" ] || die 'The configured company folder must use the work Git identity.'
   [ -z "$(git config --file "$test_home/.gitconfig" --get commit.gpgSign 2>/dev/null || true)" ] || die 'Signing must not be enabled globally.'