fix(scripts): pin shellspec install to latest release tag

Use x-gh-get-latest-version to fetch the latest release tag from
GitHub and clone/checkout that specific version. Addresses supply
chain concern and normalizes --depth=1 style.
This commit is contained in:
2026-03-02 02:41:33 +02:00
parent 9584b2ccd1
commit 039c4e0f42

View File

@@ -10,16 +10,21 @@ SHELLSPEC_CACHE="$HOME/.cache/shellspec"
install_shellspec()
{
local version
version=$(x-gh-get-latest-version shellspec/shellspec)
msgr ok "Latest shellspec version: $version"
if [[ -d "$SHELLSPEC_CACHE" ]]; then
msgr ok "shellspec repo already cloned, pulling latest..."
git -C "$SHELLSPEC_CACHE" pull --quiet --depth=1
msgr ok "shellspec repo already cloned, fetching $version..."
git -C "$SHELLSPEC_CACHE" fetch --depth=1 origin "refs/tags/$version"
git -C "$SHELLSPEC_CACHE" checkout "$version"
else
git clone --depth 1 "$SHELLSPEC_REPO" "$SHELLSPEC_CACHE"
git clone --branch "$version" --depth=1 "$SHELLSPEC_REPO" "$SHELLSPEC_CACHE"
fi
msgr run "Running make install..."
make -C "$SHELLSPEC_CACHE" install PREFIX="$HOME/.local"
msgr run_done "shellspec installed to $HOME/.local/bin/shellspec"
msgr run_done "shellspec $version installed to $HOME/.local/bin/shellspec"
return 0
}