From f3dd6adb46b39a5b89cfa497bc5f6cf06f3f4bce Mon Sep 17 00:00:00 2001
From: Szymon Osiecki <szymonos@outlook.com>
Date: Sat, 28 Feb 2026 18:54:54 +0100
Subject: [PATCH 1/4] refactor(sh): install_base - add fd

---
 .assets/provision/install_base.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.assets/provision/install_base.sh b/.assets/provision/install_base.sh
index 57a3fda8..e22a6c79 100755
--- a/.assets/provision/install_base.sh
+++ b/.assets/provision/install_base.sh
@@ -4,7 +4,7 @@ sudo .assets/provision/install_base.sh $(id -un)
 '
 set -eu
 
-if [ $(id -u) -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
   printf '\e[31;1mRun the script as root.\e[0m\n' >&2
   exit 1
 fi
@@ -64,7 +64,7 @@ alpine)
   # update package index
   apk update 2>/dev/null || true
   # install base packages
-  pkgs="bash bind-tools build-base ca-certificates curl iputils gawk git jq less lsb-release-minimal mandoc nmap openssh-client shfmt openssl sudo tar tig tree unzip vim which whois"
+  pkgs="bash bind-tools build-base ca-certificates curl fd gawk git iputils jq less lsb-release-minimal mandoc nmap openssh-client shfmt openssl sudo tar tig tree unzip vim which whois"
   install_pkgs apk "$pkgs"
   ;;
 arch)
@@ -73,7 +73,7 @@ arch)
   # refresh package database and install archlinux-keyring
   pacman -Sy --needed --noconfirm --color=auto archlinux-keyring
   # install base packages
-  pkgs="base-devel bash-completion curl dnsutils gawk git jq lsb-release man-db nmap openssh shfmt openssl tar tig tree unzip vim wget which whois"
+  pkgs="base-devel bash-completion curl dnsutils fd gawk git jq lsb-release man-db nmap openssh shfmt openssl tar tig tree unzip vim wget which whois"
   install_pkgs pacman "$pkgs"
   # install paru
   if ! pacman -Qqe paru >/dev/null 2>&1; then
@@ -96,10 +96,10 @@ fedora)
   # install development tools group
   rpm -q patch >/dev/null 2>&1 || dnf group install -y development-tools 2>/dev/null || true
   # install base packages
-  if [ "$(readlink $(which dnf))" = 'dnf5' ]; then
-    pkgs="bash-completion bind-utils curl dnf5-plugins gawk git iputils jq man-db nmap shfmt openssl tar tig tree unzip vim wget which whois"
+  if [ "$(readlink "$(which dnf)")" = 'dnf5' ]; then
+    pkgs="bash-completion bind-utils curl dnf5-plugins fd gawk git iputils jq man-db nmap shfmt openssl tar tig tree unzip vim wget which whois"
   else
-    pkgs="bash-completion bind-utils curl dnf-plugins-core gawk git iputils jq man-db nmap shfmt openssl tar tig tree unzip vim wget which whois"
+    pkgs="bash-completion bind-utils curl dnf-plugins-core fd gawk git iputils jq man-db nmap shfmt openssl tar tig tree unzip vim wget which whois"
   fi
   install_pkgs dnf "$pkgs"
   ;;
@@ -108,7 +108,7 @@ debian | ubuntu)
   # refresh package index
   apt-get update 2>/dev/null
   # install base packages
-  pkgs="build-essential bash-completion ca-certificates curl gawk gnupg dnsutils git iputils-tracepath jq lsb-release man-db nmap shfmt openssl tar tig tree unzip vim wget which whois"
+  pkgs="build-essential bash-completion ca-certificates curl fd gawk gnupg dnsutils git iputils-tracepath jq lsb-release man-db nmap shfmt openssl tar tig tree unzip vim wget which whois"
   install_pkgs apt "$pkgs"
   # autoremove unnecessary packages and clean up apt cache
   apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
@@ -119,7 +119,7 @@ opensuse)
   # install development tools pattern
   rpm -q patch >/dev/null 2>&1 || zypper --non-interactive --no-refresh in -yt pattern devel_basis 2>/dev/null || true
   # install base packages
-  pkgs="bash-completion bind-utils curl gawk git jq lsb-release nmap shfmt openssl tar tig tree unzip vim wget which whois"
+  pkgs="bash-completion bind-utils curl fd gawk git jq lsb-release nmap shfmt openssl tar tig tree unzip vim wget which whois"
   install_pkgs zypper "$pkgs"
   ;;
 esac

From ce4b779a8c859948f2a2bb75c4046d4476882c6a Mon Sep 17 00:00:00 2001
From: Szymon Osiecki <szymonos@outlook.com>
Date: Sat, 28 Feb 2026 20:02:26 +0100
Subject: [PATCH 2/4] fix(sh): shellcheck warnings

---
 .assets/config/bash_cfg/aliases_git.sh      |  4 +-
 .assets/config/bash_cfg/functions.sh        |  9 ++--
 .assets/docker/build_docker.sh              |  2 +
 .assets/provision/fix_azcli_certs.sh        |  4 +-
 .assets/provision/fix_certifi_certs.sh      |  6 +--
 .assets/provision/fix_gcloud_certs.sh       |  2 +-
 .assets/provision/fix_secure_path.sh        |  2 +-
 .assets/provision/install_docker.sh         | 46 +++++++++++++++++----
 .assets/provision/install_edge.sh           |  2 +-
 .assets/provision/install_gcloud.sh         |  2 +-
 .assets/provision/install_gh.sh             |  2 +-
 .assets/provision/install_k3d.sh            |  2 +-
 .assets/provision/install_kubecolor.sh      |  2 +-
 .assets/provision/install_kubeseal.sh       |  4 +-
 .assets/provision/install_omp.sh            |  4 +-
 .assets/provision/install_terraform.sh      |  2 +-
 .assets/provision/setup_gh_repos.sh         |  2 +-
 .assets/provision/setup_profile_allusers.sh |  2 +-
 .assets/provision/source.sh                 |  4 +-
 .assets/provision/upgrade_system.sh         |  2 +-
 .assets/scripts/linux_setup.sh              |  8 ++--
 .pre-commit-config.yaml                     |  2 +-
 22 files changed, 74 insertions(+), 41 deletions(-)

diff --git a/.assets/config/bash_cfg/aliases_git.sh b/.assets/config/bash_cfg/aliases_git.sh
index 1b10b295..99191212 100644
--- a/.assets/config/bash_cfg/aliases_git.sh
+++ b/.assets/config/bash_cfg/aliases_git.sh
@@ -32,12 +32,12 @@ function git_resolve_branch {
 
 function gsw {
   br=$(git_resolve_branch $1)
-  git switch $(git_resolve_branch $br)
+  git switch "$(git_resolve_branch "$br")"
 }
 
 function grmb {
   br=$(git_resolve_branch $1)
-  git reset $(git merge-base $(grt)/$br HEAD)
+  git reset "$(git merge-base "$(grt)"/"$br" HEAD)"
 }
 #endregion
 
diff --git a/.assets/config/bash_cfg/functions.sh b/.assets/config/bash_cfg/functions.sh
index 68b2cf6b..ff97b051 100644
--- a/.assets/config/bash_cfg/functions.sh
+++ b/.assets/config/bash_cfg/functions.sh
@@ -9,7 +9,7 @@ function sysinfo {
   cpu_name="$(sed -En '/^model name\s*: (.+)/{s//\1/;p;q}' /proc/cpuinfo)"
   cpu_cores="$(sed -En '/^cpu cores\s*: ([0-9]+)/{s//\1/;p;q}' /proc/cpuinfo)"
   # calculate memory usage
-  mem_inf=($(awk -F ':|kB' '/MemTotal:|MemAvailable:/ {printf $2, " "}' /proc/meminfo))
+  mapfile -t mem_inf < <(awk -F ':|kB' '/MemTotal:|MemAvailable:/ {print $2}' /proc/meminfo)
   mem_total=${mem_inf[0]}
   mem_used=$((mem_total - mem_inf[1]))
   mem_perc=$(awk '{printf "%.0f", $1 * $2 / $3}' <<<"$mem_used 100 $mem_total")
@@ -37,7 +37,7 @@ function sysinfo {
   printf "$SYS_PROP\n"
 }
 # set alias
-alias sysinfo='gsi'
+alias gsi='sysinfo'
 
 # *Function for fixing Python SSL certificate issues by adding custom certificates to certifi's cacert.pem
 function fixcertpy {
@@ -65,8 +65,9 @@ function fixcertpy {
   esac
 
   # get list of installed certificates
-  cert_paths=($(ls $CERT_PATH/*.crt 2>/dev/null))
-  if [ -z "$cert_paths" ]; then
+  mapfile -t cert_paths < <(ls "$CERT_PATH"/*.crt 2>/dev/null || true)
+  if [ "${#cert_paths[@]}" -eq 0 ]; then
+    printf '\033[36mno custom certificates found in \033[4m%s\n\033[0m' "$CERT_PATH" >&2
     return 0
   fi
 
diff --git a/.assets/docker/build_docker.sh b/.assets/docker/build_docker.sh
index b8021baf..16785174 100755
--- a/.assets/docker/build_docker.sh
+++ b/.assets/docker/build_docker.sh
@@ -3,6 +3,8 @@
 : '
 .assets/docker/build_docker.sh
 '
+set -e
+
 # set script working directory to workspace folder
 cd "$(readlink -f "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/../../")"
 
diff --git a/.assets/provision/fix_azcli_certs.sh b/.assets/provision/fix_azcli_certs.sh
index afeda723..f0daff42 100755
--- a/.assets/provision/fix_azcli_certs.sh
+++ b/.assets/provision/fix_azcli_certs.sh
@@ -28,8 +28,8 @@ debian | ubuntu)
 esac
 
 # get list of installed certificates
-cert_paths=($(ls $CERT_PATH/*.crt 2>/dev/null))
-if [ -z "$cert_paths" ]; then
+mapfile -t cert_paths < <(ls "$CERT_PATH"/*.crt 2>/dev/null || true)
+if [ "${#cert_paths[@]}" -eq 0 ]; then
   printf '\nThere are no certificate(s) to install.\n' >&2
   exit 0
 fi
diff --git a/.assets/provision/fix_certifi_certs.sh b/.assets/provision/fix_certifi_certs.sh
index 8c0be542..68232058 100755
--- a/.assets/provision/fix_certifi_certs.sh
+++ b/.assets/provision/fix_certifi_certs.sh
@@ -29,8 +29,8 @@ opensuse)
 esac
 
 # get list of installed certificates
-cert_paths=($(ls $CERT_PATH/*.crt 2>/dev/null))
-if [ -z "$cert_paths" ]; then
+mapfile -t cert_paths < <(ls "$CERT_PATH"/*.crt 2>/dev/null || true)
+if [ "${#cert_paths[@]}" -eq 0 ]; then
   exit 0
 fi
 
@@ -59,7 +59,7 @@ if [ -n "$SHOW" ]; then
 fi
 
 # exit script if no certify cacert.pem found
-if [ -z "$certify_paths" ]; then
+if [ "${#certify_paths[@]}" -eq 0 ]; then
   printf '\e[33mcertifi/cacert.pem not found\e[0m\n' >&2
   exit 0
 fi
diff --git a/.assets/provision/fix_gcloud_certs.sh b/.assets/provision/fix_gcloud_certs.sh
index 47a12174..c79236f6 100755
--- a/.assets/provision/fix_gcloud_certs.sh
+++ b/.assets/provision/fix_gcloud_certs.sh
@@ -25,7 +25,7 @@ opensuse)
   CERT_PATH='/usr/share/pki/trust/anchors'
 esac
 
-cert_files=($(find "$CERT_PATH" -maxdepth 1 -name '*.crt' 2>/dev/null || true))
+mapfile -t cert_files < <(find "$CERT_PATH" -maxdepth 1 -name '*.crt' 2>/dev/null || true)
 if [ "${#cert_files[@]}" -eq 0 ]; then
   printf '\nNo custom certificates found in %s\n' "$CERT_PATH" >&2
   exit 0
diff --git a/.assets/provision/fix_secure_path.sh b/.assets/provision/fix_secure_path.sh
index 13bcdb4b..ab8b2a3d 100755
--- a/.assets/provision/fix_secure_path.sh
+++ b/.assets/provision/fix_secure_path.sh
@@ -4,7 +4,7 @@ sudo .assets/provision/fix_secure_path.sh
 '
 set -eu
 
-if [ $(id -u) -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
   printf '\e[31;1mRun the script as root.\e[0m\n' >&2
   exit 1
 fi
diff --git a/.assets/provision/install_docker.sh b/.assets/provision/install_docker.sh
index e2330cea..36fe90f9 100755
--- a/.assets/provision/install_docker.sh
+++ b/.assets/provision/install_docker.sh
@@ -95,12 +95,33 @@ case $SYS_ID in
 arch)
   pacman -Sy --needed --noconfirm docker docker-compose
   ;;
+debian)
+  export DEBIAN_FRONTEND=noninteractive
+  if dpkg -s docker &>/dev/null; then
+    apt-get remove docker docker-engine docker.io containerd runc 2>/dev/null
+  fi
+  if [ ! -f /etc/apt/sources.list.d/docker.sources ]; then
+    # add Docker's official GPG key
+    install -m 0755 -d /etc/apt/keyrings
+    curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+    chmod a+r /etc/apt/keyrings/docker.asc
+    # add the repository to Apt sources
+    cat <<EOF > /etc/apt/sources.list.d/docker.sources
+Types: deb
+URIs: https://download.docker.com/linux/debian
+Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
+Components: stable
+Signed-By: /etc/apt/keyrings/docker.asc
+EOF
+  fi
+  apt-get update && apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+  ;;
 fedora)
   if rpm -q docker &>/dev/null; then
     dnf remove docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-selinux docker-engine-selinux docker-engine
   fi
   if [ ! -f /etc/yum.repos.d/docker-ce.repo ]; then
-    if [ "$(readlink $(which dnf))" = 'dnf5' ]; then
+    if [ "$(readlink "$(which dnf)")" = 'dnf5' ]; then
       dnf config-manager addrepo --from-repofile https://download.docker.com/linux/fedora/docker-ce.repo
     else
       dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
@@ -108,19 +129,26 @@ fedora)
   fi
   dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
   ;;
-debian | ubuntu)
+ubuntu)
   export DEBIAN_FRONTEND=noninteractive
   if dpkg -s docker &>/dev/null; then
     apt-get remove docker docker-engine docker.io containerd runc 2>/dev/null
   fi
-  if [ ! -f /etc/apt/sources.list.d/docker.list ]; then
-    mkdir -m 0755 -p /etc/apt/keyrings
-    curl -fsSLk "https://download.docker.com/linux/$SYS_ID/gpg" | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-    echo \
-      "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/$SYS_ID \
-      "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" >/etc/apt/sources.list.d/docker.list
+  if [ ! -f /etc/apt/sources.list.d/docker.sources ]; then
+    # add Docker's official GPG key
+    install -m 0755 -d /etc/apt/keyrings
+    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+    chmod a+r /etc/apt/keyrings/docker.asc
+    # add the repository to Apt sources
+    cat <<EOF > /etc/apt/sources.list.d/docker.sources
+Types: deb
+URIs: https://download.docker.com/linux/ubuntu
+Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
+Components: stable
+Signed-By: /etc/apt/keyrings/docker.asc
+EOF
   fi
-  apt-get update && apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin docker-compose
+  apt-get update && apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
   ;;
 opensuse)
   zypper --non-interactive in -y docker containerd docker-compose
diff --git a/.assets/provision/install_edge.sh b/.assets/provision/install_edge.sh
index ab2237e9..ee57076c 100755
--- a/.assets/provision/install_edge.sh
+++ b/.assets/provision/install_edge.sh
@@ -32,7 +32,7 @@ arch)
 fedora)
   rpm --import 'https://packages.microsoft.com/keys/microsoft.asc'
   if [ ! -f /etc/yum.repos.d/microsoft-edge-stable.repo ]; then
-    if [ "$(readlink $(which dnf))" = 'dnf5' ]; then
+    if [ "$(readlink "$(which dnf)")" = 'dnf5' ]; then
       dnf config-manager addrepo --from-repofile https://packages.microsoft.com/yumrepos/edge
     else
       dnf config-manager --add-repo https://packages.microsoft.com/yumrepos/edge
diff --git a/.assets/provision/install_gcloud.sh b/.assets/provision/install_gcloud.sh
index 4e096652..431182d5 100755
--- a/.assets/provision/install_gcloud.sh
+++ b/.assets/provision/install_gcloud.sh
@@ -76,7 +76,7 @@ install_from_tarball() {
   fi
 
   tar -zxf "$tmp_dir/$archive_name" -C "$tmp_dir"
-  rm -rf "$install_dir/$gcloud_dir"
+  rm -rf "${install_dir:?}/${gcloud_dir:?}"
   mkdir -p "$install_dir"
   mv "$tmp_dir/$gcloud_dir" "$install_dir" >/dev/null
 
diff --git a/.assets/provision/install_gh.sh b/.assets/provision/install_gh.sh
index b0fb23e2..8e8281c2 100755
--- a/.assets/provision/install_gh.sh
+++ b/.assets/provision/install_gh.sh
@@ -52,7 +52,7 @@ fedora)
   if dnf info -y gh >/dev/null 2>&1; then
     dnf install -y gh >&2 2>/dev/null
   else
-    if [ "$(readlink $(which dnf))" = 'dnf5' ]; then
+    if [ "$(readlink "$(which dnf)")" = 'dnf5' ]; then
       dnf config-manager addrepo --from-repofile https://cli.github.com/packages/rpm/gh-cli.repo
     else
       dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
diff --git a/.assets/provision/install_k3d.sh b/.assets/provision/install_k3d.sh
index c404050b..9132c452 100755
--- a/.assets/provision/install_k3d.sh
+++ b/.assets/provision/install_k3d.sh
@@ -39,7 +39,7 @@ retry_count=0
 while
   curl -sk 'https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh' | bash >&2
   ((retry_count++)) || true
-  [[ $(k3d --version 2>/dev/null | sed -En 's/.*v([0-9\.]+)$/\1/p') != $REL && $retry_count -le 10 ]]
+  [[ $(k3d --version 2>/dev/null | sed -En 's/.*v([0-9\.]+)$/\1/p') != "$REL" && $retry_count -le 10 ]]
 do :; done
 
 exit 0
diff --git a/.assets/provision/install_kubecolor.sh b/.assets/provision/install_kubecolor.sh
index 9bb3795a..0c25e368 100755
--- a/.assets/provision/install_kubecolor.sh
+++ b/.assets/provision/install_kubecolor.sh
@@ -54,7 +54,7 @@ fi
 printf "\e[92minstalling \e[1m$APP\e[22m v$REL\e[0m\n" >&2
 case $SYS_ID in
 fedora)
-  if [ "$(readlink $(which dnf))" = 'dnf5' ]; then
+  if [ "$(readlink "$(which dnf)")" = 'dnf5' ]; then
     dnf config-manager addrepo --from-repofile https://kubecolor.github.io/packages/rpm/kubecolor.repo
   else
     dnf config-manager --add-repo https://kubecolor.github.io/packages/rpm/kubecolor.repo
diff --git a/.assets/provision/install_kubeseal.sh b/.assets/provision/install_kubeseal.sh
index 1f7ab5d9..5a902c5b 100755
--- a/.assets/provision/install_kubeseal.sh
+++ b/.assets/provision/install_kubeseal.sh
@@ -26,10 +26,10 @@ elif [ -z "$URL" ]; then
   printf "\e[31mError: The download URL is required.\e[0m\n" >&2
   exit 1
 else
-  response="{\"version\":\"$REL\",\"download_url\":\"$URL\"}"
+  response=$(printf '{"version":"%s","download_url":"%s"}' "$REL" "$URL")
 fi
 # return json response
-echo $response
+echo "$response"
 
 # exit if the URL is not set
 if [ -z "$URL" ]; then
diff --git a/.assets/provision/install_omp.sh b/.assets/provision/install_omp.sh
index eb2aaf4f..2e8c93b4 100755
--- a/.assets/provision/install_omp.sh
+++ b/.assets/provision/install_omp.sh
@@ -26,10 +26,10 @@ elif [ -z "$URL" ]; then
   printf "\e[31mError: The download URL is required.\e[0m\n" >&2
   exit 1
 else
-  response="{\"version\":\"$REL\",\"download_url\":\"$URL\"}"
+  response=$(printf '{"version":"%s","download_url":"%s"}' "$REL" "$URL")
 fi
 # return json response
-echo $response
+echo "$response"
 
 if type $APP &>/dev/null; then
   VER=$(oh-my-posh version)
diff --git a/.assets/provision/install_terraform.sh b/.assets/provision/install_terraform.sh
index ebf1ad58..ab928abe 100755
--- a/.assets/provision/install_terraform.sh
+++ b/.assets/provision/install_terraform.sh
@@ -58,7 +58,7 @@ arch)
   pacman -Sy --needed --noconfirm terraform >&2 2>/dev/null
   ;;
 fedora)
-  if [ "$(readlink $(which dnf))" = 'dnf5' ]; then
+  if [ "$(readlink "$(which dnf)")" = 'dnf5' ]; then
     dnf config-manager addrepo --from-repofile https://rpm.releases.hashicorp.com/fedora/hashicorp.repo
   else
     dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
diff --git a/.assets/provision/setup_gh_repos.sh b/.assets/provision/setup_gh_repos.sh
index 28ba4b0c..5ecce813 100755
--- a/.assets/provision/setup_gh_repos.sh
+++ b/.assets/provision/setup_gh_repos.sh
@@ -17,7 +17,7 @@ while [ $# -gt 0 ]; do
 done
 
 # *calculate variables
-gh_repos=($repos)
+read -ra gh_repos <<< "$repos"
 # calculate workspace name
 if [ -n "$WSL_DISTRO_NAME" ]; then
   ID="$WSL_DISTRO_NAME"
diff --git a/.assets/provision/setup_profile_allusers.sh b/.assets/provision/setup_profile_allusers.sh
index f26d376f..be4b5c34 100755
--- a/.assets/provision/setup_profile_allusers.sh
+++ b/.assets/provision/setup_profile_allusers.sh
@@ -85,7 +85,7 @@ grep -qw 'completion-ignore-case' /etc/inputrc || echo 'set completion-ignore-ca
 [ -f /etc/localtime ] || ln -s /usr/share/zoneinfo/UTC /etc/localtime
 
 # *add reboot/shutdown polkit rule for vagrant group
-if grep -qw '^vagrant' <<<$(getent group) && [[ ! -f /usr/share/polkit-1/rules.d/49-nopasswd_shutdown.rules && -d /usr/share/polkit-1/rules.d ]]; then
+if grep -qw '^vagrant' <<<"$(getent group)" && [[ ! -f /usr/share/polkit-1/rules.d/49-nopasswd_shutdown.rules && -d /usr/share/polkit-1/rules.d ]]; then
   cat <<EOF >/usr/share/polkit-1/rules.d/49-nopasswd_shutdown.rules
 /* Allow members of the vagrant group to shutdown or restart
  * without password authentication.
diff --git a/.assets/provision/source.sh b/.assets/provision/source.sh
index 0a6280fd..bc0f2089 100755
--- a/.assets/provision/source.sh
+++ b/.assets/provision/source.sh
@@ -133,13 +133,13 @@ download_file() {
   [ -z "$target_dir" ] && target_dir='.' || true
 
   # define local variables
-  local file_name="$(basename $uri)"
+  local file_name="$(basename "$uri")"
   local max_retries=8
   local retry_count=0
 
   while [ $retry_count -le $max_retries ]; do
     # download file
-    status_code=$(curl -w %{http_code} -#Lko "$target_dir/$file_name" "$uri" 2>/dev/null)
+    status_code=$(curl -w '%{http_code}' -#Lko "$target_dir/$file_name" "$uri" 2>/dev/null)
 
     # check the HTTP status code
     case $status_code in
diff --git a/.assets/provision/upgrade_system.sh b/.assets/provision/upgrade_system.sh
index de1a77ec..22426052 100755
--- a/.assets/provision/upgrade_system.sh
+++ b/.assets/provision/upgrade_system.sh
@@ -4,7 +4,7 @@ sudo .assets/provision/upgrade_system.sh
 '
 set -eu
 
-if [ $(id -u) -ne 0 ]; then
+if [ "$(id -u)" -ne 0 ]; then
   printf '\e[31;1mRun the script as root.\e[0m\n' >&2
   exit 1
 fi
diff --git a/.assets/scripts/linux_setup.sh b/.assets/scripts/linux_setup.sh
index 348498ae..3eb8fc3a 100755
--- a/.assets/scripts/linux_setup.sh
+++ b/.assets/scripts/linux_setup.sh
@@ -19,6 +19,8 @@ omp_theme="nerd"
 # :skip GitHub authentication setup
 .assets/scripts/linux_setup.sh --skip_gh_auth true --scope "$scope" --omp_theme "$omp_theme"
 '
+set -e
+
 if [ $EUID -eq 0 ]; then
   printf '\e[31;1mDo not run the script as root.\e[0m\n'
   exit 1
@@ -48,7 +50,7 @@ pushd "$(cd "${SCRIPT_ROOT}/../../" && pwd)" >/dev/null
 distro_check=$(.assets/provision/distro_check.sh array)
 
 # initialize the scopes array
-array=($scope)
+read -ra array <<<"$scope"
 # populate the scopes array based on the output of distro_check.sh
 while IFS= read -r line; do
   array+=("$line")
@@ -98,7 +100,7 @@ done
 # get distro name from os-release
 . /etc/os-release
 # display distro name and scopes to install
-printf "\e[95m$NAME$([ -n "$scope_arr" ] && echo " : \e[3m${scope_arr[*]}" || true)\e[0m\n"
+printf "\e[95m$NAME$([ "${#scope_arr[@]}" -gt 0 ] && echo " : \e[3m${scope_arr[*]}" || true)\e[0m\n"
 
 # *Install packages and setup profiles
 if [ "$sys_upgrade" = true ]; then
@@ -249,7 +251,7 @@ printf "\e[96msetting up profile for current user...\e[0m\n"
 # install powershell modules
 if [ -f /usr/bin/pwsh ]; then
   cmnd="Import-Module (Resolve-Path './modules/InstallUtils'); Invoke-GhRepoClone -OrgRepo 'szymonos/ps-modules'"
-  cloned=$(pwsh -nop -c $cmnd)
+  cloned=$(pwsh -nop -c "$cmnd")
   if [ $cloned -gt 0 ]; then
     printf "\e[96minstalling ps-modules...\e[0m\n"
     # install do-common module for all users
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 17f45693..fe92ff45 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -25,5 +25,5 @@ repos:
     rev: v0.11.0
     hooks:
       - id: shellcheck
-        args: ["--severity=error", "--exclude=SC2148,SC2139"]
+        args: ["--severity=warning", "--exclude=SC1090,SC2139,SC2148,SC2155,SC2174"]
         exclude: \.zsh$

From c996935993db9f7a5ae8bf4ae94e8c4cc6fb8a1e Mon Sep 17 00:00:00 2001
From: Szymon Osiecki <szymonos@outlook.com>
Date: Sat, 28 Feb 2026 20:43:43 +0100
Subject: [PATCH 3/4] chore: bump dependencies

---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index fe92ff45..b9fbc0c9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -16,7 +16,7 @@ repos:
       - id: trailing-whitespace
         exclude: \.md$
   - repo: https://github.com/DavidAnson/markdownlint-cli2
-    rev: v0.20.0
+    rev: v0.21.0
     hooks:
       - id: markdownlint-cli2
         files: \.md$

From c6595f49d9df5be1e440730dbb5b3e2ee4726835 Mon Sep 17 00:00:00 2001
From: Szymon Osiecki <szymonos@outlook.com>
Date: Sat, 28 Feb 2026 20:55:29 +0100
Subject: [PATCH 4/4] feat: Makefile

---
 .editorconfig |  4 ++++
 Makefile      | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 Makefile

diff --git a/.editorconfig b/.editorconfig
index dadcf935..a8b4b781 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -18,3 +18,7 @@ trim_trailing_whitespace = true
 
 [*.md]
 trim_trailing_whitespace = false
+
+[Makefile]
+indent_size = 2
+indent_style = tab
diff --git a/Makefile b/Makefile
new file mode 100644
index 00000000..39348693
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,38 @@
+# Makefile for AI Search EEAT Project
+# Provides convenient shortcuts for common development tasks
+
+# Use bash for all commands to ensure consistent behavior across all invoking shells
+SHELL := /bin/bash
+
+# Default target
+.DEFAULT_GOAL := help
+
+.PHONY: help
+help: ## Show this help message
+	@printf 'Usage: make [target]\n\n'
+	@printf "\033[1;97mAvailable targets:\033[0m\n"
+	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "  \033[1;94m%-30s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
+
+.PHONY: install
+install: ## Install pre-commit hooks
+	@printf "🔧 Installing pre-commit hooks...\n"
+	prek install
+
+.PHONY: update
+update: ## Update prek and repositories versions
+	@printf "\n✅ All dependencies upgraded\n\n"
+	prek self update
+	prek auto-update
+
+.PHONY: lint lint-all lint-diff
+lint: ## Run pre-commit hooks for changed files
+	@printf "🧭 Running pre-commit hooks for changed files...\n\n"
+	git add --all && prek run
+
+lint-all: ## Run pre-commit hooks for all files
+	@printf "🧭 Running pre-commit hooks for all files...\n\n"
+	prek run --all-files
+
+lint-diff: ## Run pre-commit hooks for files changed in this diff
+	@printf "🧭 Running pre-commit hooks for files changed in this diff...\n\n"
+	@[ "$$(git branch --show-current)" = "main" ] && printf "⚠️  You are on the main branch. Skipping lint-diff.\n" || prek run --from-ref main --to-ref HEAD