enable shellcheck

.envrc

@@ -1 +1,2 @@
+# shellcheck shell=bash
 use flake

formatter.nix

@@ -7,6 +7,7 @@ inputs.treefmt-nix.lib.evalModule pkgs {
 
     deadnix.enable = true;
     deno.enable = true;
+    shellcheck.enable = true;
   };
 
   settings = {

pkgs/sops-import-keys-hook/sops-import-keys-hook.bash

@@ -2,7 +2,8 @@ sopsImportKeysHook() {
   local key dir
   if [ -n "${sopsCreateGPGHome}" ]; then
     export GNUPGHOME=${sopsGPGHome:-$(pwd)/.git/gnupg}
-    mkdir -m 700 -p $GNUPGHOME
+    # shellcheck disable=SC2174
+    mkdir -m 700 -p "$GNUPGHOME"
   fi
   for key in ${sopsPGPKeys-}; do
     if [[ -f "$key" ]]; then

scripts/update-vendor-hash.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p nix -p coreutils -p gnused -p gawk
+# shellcheck shell=bash
 
 set -exuo pipefail