Container test harness for install, plus the bugs it found

.github/workflows/test.yml

@@ -0,0 +1,74 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  unit:
+    name: unit (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install zsh and jq
+        run: |
+          if [ "$RUNNER_OS" = "Linux" ]; then
+            sudo apt-get update
+            sudo apt-get install -y --no-install-recommends zsh jq
+          else
+            command -v jq >/dev/null || brew install jq
+          fi
+
+      - name: Run unit tests
+        run: ./tests/run
+
+  container:
+    name: install (${{ matrix.base }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        base:
+          - debian:bookworm-slim
+          - fedora:41
+    # The runner is x86_64; the arch-alt scenario covers arm64 asset picking
+    # without paying for emulation.
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run install scenarios in a container
+        run: ./tests/run --container --base "${{ matrix.base }}"
+
+  shellcheck:
+    name: shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install shellcheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+
+      # Errors only: warnings in these scripts are mostly stylistic.
+      - name: Lint shell scripts
+        run: |
+          mapfile -t files < <(
+            find install scripts tests -type f ! -name '*.zip' ! -name '*.md' \
+              | while read -r f; do
+                  head -c 200 "$f" | grep -qE '^#!.*(bash|/sh)' && echo "$f"
+                done
+          )
+          printf 'checking %d files\n' "${#files[@]}"
+          shellcheck --severity=error --external-sources "${files[@]}"

README.md

@@ -7,9 +7,21 @@ This sets up my profile & dev environment that I use across all my machines.
 This script will clone the dotfiles repo to `~/.dotfiles` and link all the config files plus install all the packages I use.
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/jsg2021/dotfiles/main/install | sh
+curl -fsSL https://raw.githubusercontent.com/jsg2021/dotfiles/main/install | bash
 ```
 
 ## Signing commits
 
 My commit signing is handled by 1Password. If you use a different signing method, you should update the `gpg` blocks in the gitconfig. However, if you also use 1Password, you can use my setup, just set the `signingkey` property in `configs/gitconfig` to your public key.
+
+## Tests
+
+`./install` is exercised end to end inside a disposable container, so a broken
+installer is caught before it touches a real machine.
+
+```sh
+./tests/run              # fast checks, no Docker
+./tests/run --container  # full install run in a sandbox
+```
+
+See [tests/README.md](tests/README.md).

configs/.config/ghostty/setup.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 PLATFORM=macos
 if [[ "$OSTYPE" != "darwin"* ]]; then
   exit 0;

install

@@ -24,6 +24,15 @@ set -e
         # git submodule update --init --recursive
     fi
 
+    # When piped (curl | bash) $0 is not a real path, so $CWD is junk.
+    # The clone above guarantees $DIR, so fall back to it.
+    if [ ! -f "$CWD/scripts/installers/helpers" ]; then
+        CWD="$DIR"
+    fi
+
+    # Everything below (git checks, stow's .stowrc) assumes we sit in the repo.
+    cd $CWD
+
     source $CWD/scripts/installers/helpers
 
     #endregion
@@ -36,24 +45,23 @@ set -e
     #region tools
     if [ "$CODESPACES" = true ]; then
         echo "Running in codespaces...skip dev os setup"
-        return
-    else    
+    else
         variant=$(uname -s | awk '{print tolower($0)}');
-        sh $CWD/scripts/installers/$variant;
+        "$CWD/scripts/installers/$variant";
     fi
 
     #endregion
 
     # use adopt to prevent stow from complaining about existing files,
     # since we are going to reset hard anyway
-    stow configs --adopt # -vvv
+    stow --dir="$CWD" --target="$HOME" configs --adopt # -vvv
 
     if ! is_git_clean; then
         echo -e "\n\nStashing old .dotfiles that we just replaced... inspect the stash and recover or drop as needed.\n\n";
         git stash --include-untracked
     fi
 
-    sh $CWD/scripts/installers/set-zsh
+    "$CWD/scripts/installers/set-zsh"
 
     echo "Installation complete!"
 }

scripts/installers/app/1password

@@ -2,6 +2,9 @@
 # set -x
 set -e
 
+DIR=$(dirname -- "$(readlink -f -- "$0")")
+source "$DIR/../helpers"
+
 if [[ "$OSTYPE" == "darwin"* ]]; then
     if [ ! -d "/Applications/1Password.app" ]; then
     (
@@ -13,17 +16,17 @@ if [[ "$OSTYPE" == "darwin"* ]]; then
             open "1Password Installer.app"
     )
     fi
-elif ! command -v 1password &> /dev/null; then           
+elif ! has_binary 1password; then           
 
-    if command -v dnf &> /dev/null; then 
+    if has_binary dnf; then
 
         #1password repo
         sudo rpm --import https://downloads.1password.com/linux/keys/1password.asc
         sudo sh -c 'echo -e "[1password]\nname=1Password Stable Channel\nbaseurl=https://downloads.1password.com/linux/rpm/stable/\$basearch\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=1\ngpgkey=\"https://downloads.1password.com/linux/keys/1password.asc\"" > /etc/yum.repos.d/1password.repo'
 
         sudo dnf install 1password 1password-cli
 
-    elif command -v apt-get &> /dev/null; then
+    elif has_binary apt-get; then
 
         curl -sS https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg
         echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/amd64 stable main' | sudo tee /etc/apt/sources.list.d/1password.list

scripts/installers/app/app-image-launcher

@@ -0,0 +1,76 @@
+#!/bin/bash
+# set -x
+set -e
+
+DIR=$(dirname -- "$(readlink -f -- "$0")")
+source "$DIR/../helpers"
+
+REPO=TheAssassin/AppImageLauncher
+# The package is lowercase; the binary it ships is not.
+PKG=appimagelauncher
+BIN=AppImageLauncher
+
+function require_url() {
+    if [ -z "$1" ]; then
+        echo "No $2 asset in the latest AppImageLauncher release."
+        exit 1
+    fi
+}
+
+#region uninstall
+if has_binary "$BIN"; then
+    echo "AppImageLauncher is already installed."
+
+    # Never block an unattended install; only ask when someone is watching.
+    if [ ! -t 0 ]; then
+        exit 0
+    fi
+
+    read -p "Do you want to remove it? (y/n) " -n 1 -r
+    echo
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        exit 0
+    fi
+
+    if has_binary dnf; then
+        sudo dnf remove -y "$PKG"
+    elif has_binary apt-get; then
+        sudo apt-get remove -y "$PKG"
+    else
+        echo "No supported package manager; remove $PKG by hand."
+        exit 0
+    fi
+
+    exit 0
+fi
+#endregion
+
+#region install
+if has_binary dnf; then
+
+    # dnf installs straight from a URL. Assets are ..._x86_64.rpm /
+    # ..._aarch64.rpm / ..._armv7hl.rpm, matching `uname -m`.
+    URL=$(github_asset_url "$REPO" "_$(arch_for uname).rpm")
+    require_url "$URL" "$(arch_for uname) rpm"
+    sudo dnf install -y "$URL"
+
+elif has_binary apt-get; then
+
+    # apt cannot fetch a package by URL, so download it first. Installing the
+    # local file through apt-get (not dpkg) pulls in its dependencies.
+    # dpkg is authoritative here (it knows about an i386 userland on an amd64
+    # kernel); arch_for go is the fallback shape.
+    ARCH=$(dpkg --print-architecture 2>/dev/null || arch_for go)
+    URL=$(github_asset_url "$REPO" "_$ARCH.deb")
+    require_url "$URL" "$ARCH deb"
+
+    download_to ~/Downloads/$PKG.deb "$URL"
+    sudo apt-get update
+    sudo apt-get install -y ~/Downloads/$PKG.deb
+    rm -f ~/Downloads/$PKG.deb
+
+else
+    echo "...skipping AppImageLauncher installation $(get_distro_id)"
+    exit 0
+fi
+#endregion

scripts/installers/app/ghostty

@@ -3,22 +3,28 @@
 set -e
 
 DIR=$(dirname -- "$(readlink -f -- "$0")")
-source $DIR/../helpers
+source "$DIR/../helpers"
 
 case $(get_distro_id) in
     darwin)
-        brew install --cask ghostty        
+        brew install --cask ghostty
         ;;
     fedora|\
     debian|\
     ubuntu)
-        mkdir -p ~/Downloads
-        mkdir -p ~/.local/bin
-        API="https://api.github.com/repos/pkgforge-dev/ghostty-appimage/releases/latest"
-        curl -sL -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" $API \
-            | jq -r ".assets[] | select(.name | endswith(\"AppImage\")) | .browser_download_url" \
-            | xargs curl -fsSL -o ~/Downloads/ghostty.AppImage
+        # The release ships one AppImage per arch (…-aarch64.AppImage,
+        # …-x86_64.AppImage). Matching on ".AppImage" alone returns both.
+        SUFFIX="-$(arch_for uname).AppImage"
+        URL=$(github_asset_url pkgforge-dev/ghostty-appimage "$SUFFIX")
+
+        if [ -z "$URL" ]; then
+            echo "...skipping ghostty: no AppImage matching *$SUFFIX"
+            exit 0
+        fi
+
+        download_to ~/Downloads/ghostty.AppImage "$URL"
         chmod +x ~/Downloads/ghostty.AppImage
+        mkdir -p ~/.local/bin
         mv -f ~/Downloads/ghostty.AppImage ~/.local/bin/ghostty
         ;;
     *)
@@ -27,4 +33,4 @@ case $(get_distro_id) in
         ;;
 esac
 
-sh $DIR/../../../configs/.config/ghostty/setup.sh
+"$DIR/../../../configs/.config/ghostty/setup.sh"

scripts/installers/app/github

@@ -2,22 +2,25 @@
 # set -x
 set -e
 
+DIR=$(dirname -- "$(readlink -f -- "$0")")
+source "$DIR/../helpers"
 
 
-if ! command -v gh &> /dev/null; then
 
-    if command -v brew &> /dev/null; then 
+if ! has_binary gh; then
+
+    if has_binary brew; then
         brew install gh
 
-    elif command -v dnf &> /dev/null; then 
+    elif has_binary dnf; then
 
         sudo dnf install 'dnf-command(config-manager)'
         sudo dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
         sudo dnf install gh
 
-    elif command -v apt-get &> /dev/null; then
+    elif has_binary apt-get; then
 
-        type -p curl >/dev/null || (sudo apt update && sudo apt install curl -y)
+        has_binary curl || sudo apt-get install -y curl
         curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
         && sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
         && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \