chore: update scripts to satisfy validation

Fix ShellCheck warnings across all shell scripts:

- SC2155: Separate variable declaration and assignment to avoid masking return values
- SC2068: Quote array expansions to prevent word splitting
- SC2164: Add error handling to cd commands with || exit
- SC2088: Replace tilde with $HOME for proper expansion in quotes
- SC2206: Use robust array assignment with IFS read instead of word splitting
- SC1090: Add disable directive for non-constant source paths

All changes preserve or improve functionality while following shell scripting best practices.

Author: DevelopmentCats

.github/scripts/check_registry_site_health.sh

@@ -82,7 +82,8 @@ create_incident() {
 # Function to check for existing unresolved incidents
 check_existing_incident() {
   # Fetch the latest incidents with status not equal to "RESOLVED"
-  local unresolved_incidents=$(curl -s -X GET "https://api.instatus.com/v1/$INSTATUS_PAGE_ID/incidents" \
+  local unresolved_incidents
+  unresolved_incidents=$(curl -s -X GET "https://api.instatus.com/v1/$INSTATUS_PAGE_ID/incidents" \
     -H "Authorization: Bearer $INSTATUS_API_KEY" \
     -H "Content-Type: application/json" | jq -r '.incidents[] | select(.status != "RESOLVED") | .id')
 

registry/anomaly/modules/tmux/scripts/run.sh

@@ -144,7 +144,7 @@ main() {
   printf "$${BOLD}✅ tmux setup complete! \n\n"
 
   printf "$${BOLD} Attempting to restore sessions\n"
-  tmux new-session -d \; source-file ~/.tmux.conf \; run-shell '~/.tmux/plugins/tmux-resurrect/scripts/restore.sh'
+  tmux new-session -d \; source-file ~/.tmux.conf \; run-shell "$HOME/.tmux/plugins/tmux-resurrect/scripts/restore.sh"
   printf "$${BOLD} Sessions restored: -> %s\n" "$(tmux ls)"
 
 }

registry/coder-labs/modules/archive/run.sh

@@ -6,8 +6,8 @@ EXTRACT_ON_START="${TF_EXTRACT_ON_START}"
 EXTRACT_WAIT_TIMEOUT="${TF_EXTRACT_WAIT_TIMEOUT}"
 
 # Set script defaults from Terraform.
-DEFAULT_PATHS=(${TF_PATHS})
-DEFAULT_EXCLUDE_PATTERNS=(${TF_EXCLUDE_PATTERNS})
+IFS=' ' read -r -a DEFAULT_PATHS <<< "${TF_PATHS}"
+IFS=' ' read -r -a DEFAULT_EXCLUDE_PATTERNS <<< "${TF_EXCLUDE_PATTERNS}"
 DEFAULT_COMPRESSION="${TF_COMPRESSION}"
 DEFAULT_ARCHIVE_PATH="${TF_ARCHIVE_PATH}"
 DEFAULT_DIRECTORY="${TF_DIRECTORY}"
@@ -62,6 +62,7 @@ echo "Installed extract script to:  $EXTRACT_WRAPPER_PATH"
 
 # 3) Optionally wait for and extract an archive on start.
 if [[ $EXTRACT_ON_START = true ]]; then
+  # shellcheck disable=SC1090
   . "$LIB_PATH"
 
   archive_wait_and_extract "$EXTRACT_WAIT_TIMEOUT" quiet || {

registry/coder/modules/code-server/run.sh

@@ -88,6 +88,7 @@ function extension_installed() {
   if [ "${USE_CACHED_EXTENSIONS}" != true ]; then
     return 1
   fi
+  # shellcheck disable=SC2066
   for _extension in "$${EXTENSIONS_ARRAY[@]}"; do
     if [ "$_extension" == "$1" ]; then
       echo "Extension $1 was already installed."
@@ -99,6 +100,7 @@ function extension_installed() {
 
 # Install each extension...
 IFS=',' read -r -a EXTENSIONLIST <<< "$${EXTENSIONS}"
+# shellcheck disable=SC2066
 for extension in "$${EXTENSIONLIST[@]}"; do
   if [ -z "$extension" ]; then
     continue

registry/coder/modules/devcontainers-cli/run.sh

@@ -4,7 +4,7 @@
 # might contain a `package.json` with `packageManager` set to something
 # other than the detected package manager. When this happens, it can
 # cause the installation to fail.
-cd "$CODER_SCRIPT_DATA_DIR"
+cd "$CODER_SCRIPT_DATA_DIR" || exit
 
 # If @devcontainers/cli is already installed, we can skip
 if command -v devcontainer > /dev/null 2>&1; then

registry/coder/modules/dotfiles/run.sh

@@ -5,6 +5,7 @@ set -euo pipefail
 DOTFILES_URI="${DOTFILES_URI}"
 DOTFILES_USER="${DOTFILES_USER}"
 
+# shellcheck disable=SC2157
 if [ -n "$${DOTFILES_URI// }" ]; then
   if [ -z "$DOTFILES_USER" ]; then
     DOTFILES_USER="$USER"

registry/coder/modules/git-clone/run.sh

@@ -60,7 +60,7 @@ if [ -n "$POST_CLONE_SCRIPT" ]; then
   echo "Running post-clone script..."
   echo "$POST_CLONE_SCRIPT" | base64 -d > /tmp/post_clone.sh
   chmod +x /tmp/post_clone.sh
-  cd "$CLONE_PATH"
+  cd "$CLONE_PATH" || exit
   /tmp/post_clone.sh
   rm /tmp/post_clone.sh
 fi

registry/coder/modules/slackme/slackme.sh

@@ -73,13 +73,13 @@ fi
 
 START=$(date +%s%N)
 # Run all arguments as a command
-$@
+"$@"
 END=$(date +%s%N)
 DURATION_MS=$${DURATION_MS:-$(((END - START) / 1000000))}
 PRETTY_DURATION=$(pretty_duration $DURATION_MS)
 
 set -e
-COMMAND=$(echo $@)
+COMMAND=$(echo "$@")
 SLACK_MESSAGE=$(echo "$SLACK_MESSAGE" | sed "s|\\$COMMAND|$COMMAND|g")
 SLACK_MESSAGE=$(echo "$SLACK_MESSAGE" | sed "s|\\$DURATION|$PRETTY_DURATION|g")
 

registry/coder/modules/vault-github/run.sh

@@ -46,6 +46,7 @@ install() {
   if [ "$${INSTALL_VERSION}" = "latest" ]; then
     LATEST_VERSION=$(curl -s https://releases.hashicorp.com/vault/ | grep -v 'rc' | grep -oE 'vault/[0-9]+\.[0-9]+\.[0-9]+' | sed 's/vault\///' | sort -V | tail -n 1)
     printf "Latest version of Vault is %s.\n\n" "$${LATEST_VERSION}"
+    # shellcheck disable=SC2157
     if [ -z "$${LATEST_VERSION}" ]; then
       printf "Failed to determine the latest Vault version.\n"
       return 1
@@ -63,8 +64,10 @@ install() {
     fi
   fi
 
+  # shellcheck disable=SC2170
   if [ $${installation_needed} -eq 1 ]; then
     # Download and install Vault
+    # shellcheck disable=SC2157
     if [ -z "$${CURRENT_VERSION}" ]; then
       printf "Installing Vault CLI ...\n\n"
     else

registry/coder/modules/vault-jwt/run.sh

@@ -47,6 +47,7 @@ install() {
   if [ "$${VAULT_CLI_VERSION}" = "latest" ]; then
     LATEST_VERSION=$(curl -s https://releases.hashicorp.com/vault/ | grep -v 'rc' | grep -oE 'vault/[0-9]+\.[0-9]+\.[0-9]+' | sed 's/vault\///' | sort -V | tail -n 1)
     printf "Latest version of Vault is %s.\n\n" "$${LATEST_VERSION}"
+    # shellcheck disable=SC2157
     if [ -z "$${LATEST_VERSION}" ]; then
       printf "Failed to determine the latest Vault version.\n"
       return 1
@@ -64,8 +65,10 @@ install() {
     fi
   fi
 
+  # shellcheck disable=SC2170
   if [ $${installation_needed} -eq 1 ]; then
     # Download and install Vault
+    # shellcheck disable=SC2157
     if [ -z "$${CURRENT_VERSION}" ]; then
       printf "Installing Vault CLI ...\n\n"
     else