Fix lint issues, disable false positives

src/_utils/_git_secret_tools.sh

@@ -19,6 +19,7 @@ _SECRETS_DIR_PATHS_MAPPING="${_SECRETS_DIR_PATHS}/mapping.cfg"
 
 
 # AWK scripts:
+# shellcheck disable=2016
 AWK_FSDB_HAS_RECORD='
 BEGIN { FS=":"; OFS=":"; cnt=0; }
 {
@@ -30,6 +31,7 @@ BEGIN { FS=":"; OFS=":"; cnt=0; }
 END { if ( cnt > 0 ) print "0"; else print "1"; }
 '
 
+# shellcheck disable=2016
 AWK_FSDB_RM_RECORD='
 BEGIN { FS=":"; OFS=":"; }
 {
@@ -40,6 +42,7 @@ BEGIN { FS=":"; OFS=":"; }
 }
 '
 
+# shellcheck disable=2016
 AWK_FSDB_CLEAR_HASHES='
 BEGIN { FS=":"; OFS=":"; }
 {
@@ -47,6 +50,7 @@ BEGIN { FS=":"; OFS=":"; }
 }
 '
 
+# shellcheck disable=2016
 AWK_GPG_VER_CHECK='
 /^gpg/{
   version=$3
@@ -201,7 +205,8 @@ function _unique_filename {
 function _get_record_filename {
   # Returns 1st field from passed record
   local record="$1"
-  local filename=$(echo "$record" | awk -F: '{print $1}')
+  local filename
+  filename=$(echo "$record" | awk -F: '{print $1}')
 
   echo "$filename"
 }
@@ -210,7 +215,8 @@ function _get_record_filename {
 function _get_record_hash {
   # Returns 2nd field from passed record
   local record="$1"
-  local hash=$(echo "$record" | awk -F: '{print $2}')
+  local hash
+  hash=$(echo "$record" | awk -F: '{print $2}')
 
   echo "$hash"
 }
@@ -223,7 +229,7 @@ function _fsdb_has_record {
   local fsdb="$2" # required
 
   # 0 on contains, 1 for error.
-  gawk -v key=$key "$AWK_FSDB_HAS_RECORD" "$fsdb"
+  gawk -v key="$key" "$AWK_FSDB_HAS_RECORD" "$fsdb"
 }
 
 
@@ -233,7 +239,7 @@ function _fsdb_rm_record {
   local key="$1"  # required
   local fsdb="$2" # required
 
-  gawk -i inplace -v key=$key "$AWK_FSDB_RM_RECORD" "$fsdb"
+  gawk -i inplace -v key="$key" "$AWK_FSDB_RM_RECORD" "$fsdb"
 }
 
 function _fsdb_clear_hashes {

src/commands/git_secret_hide.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+# shellcheck disable=2016
 AWK_FSDB_UPDATE_HASH='
 BEGIN { FS=":"; OFS=":"; }
 {
@@ -39,7 +40,8 @@ function _optional_delete {
 
     while read -r line; do
       # So the formating would not be repeated several times here:
-      local filename=$(_get_record_filename "$line")
+      local filename
+      filename=$(_get_record_filename "$line")
       _find_and_clean "*$filename" "$verbose"
     done < "$path_mappings"
 
@@ -59,8 +61,8 @@ function _get_file_hash {
   local checksum_local
   local file_hash
 
-  checksum_local=$(_get_checksum_local)
-  file_hash=$($checksum_local $input_path | awk '{print $1}')
+  checksum_local="$(_get_checksum_local)"
+  file_hash=$($checksum_local "$input_path" | awk '{print $1}')
 
   echo "$file_hash"
 }
@@ -72,7 +74,7 @@ function _optional_fsdb_update_hash {
 
   fsdb=$(_get_secrets_dir_paths_mapping)
 
-  gawk -i inplace -v key=$key -v hash=$hash "$AWK_FSDB_UPDATE_HASH" "$fsdb"
+  gawk -i inplace -v key="$key" -v hash="$hash" "$AWK_FSDB_UPDATE_HASH" "$fsdb"
 }
 
 
@@ -133,7 +135,7 @@ function hide {
     input_path=$(_append_root_path "$filename")
     output_path=$(_append_root_path "$encrypted_filename")
 
-    file_hash=$(_get_file_hash $input_path)
+    file_hash=$(_get_file_hash "$input_path")
 
     # encrypt file only if required
     if [[ "$fsdb_file_hash" != "$file_hash" ]]; then

src/commands/git_secret_init.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+# shellcheck disable=2016
 AWK_ADD_TO_GITIGNORE='
 BEGIN { cnt=0; }
 {

src/commands/git_secret_tell.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+# shellcheck disable=2016
 AWK_GPG_KEY_CNT='
 BEGIN { cnt=0; OFS=":"; FS=":"; }
 flag=0; $1 == "pub" { cnt++ }