fix(lint): fix all sonarcloud detected issues (#279)

* fix(ci): replace broad permissions with specific scopes in workflows

Replace read-all/write-all with minimum required permission scopes
across all GitHub Actions workflows to follow the principle of least
privilege (SonarCloud rule githubactions:S8234).

* fix(shell): use [[ instead of [ for conditional tests

Replace single brackets with double brackets in bash conditional
expressions across 14 files (28 changes). All scripts use bash
shebangs so [[ is safe everywhere (SonarCloud rule shelldre:S7688).

* fix(shell): add explicit return statements to functions

Add return 0 as the last statement in ~46 shell functions across
17 files that previously relied on implicit return codes
(SonarCloud rule shelldre:S7682).

* fix(shell): assign positional parameters to local variables

Replace direct $1/$2/$3 usage with named local variables in _log(),
msg(), msg_err(), msg_done(), msg_run(), msg_ok(), and array_diff()
(SonarCloud rule shelldre:S7679).

* fix(python): replace dict() constructor with literal

Use {} instead of dict() for empty dictionary initialization
(SonarCloud rule python:S7498).

* fix(shell): fix husky shebang and tolerate npm outdated exit code

* docs(shell): add function docstring comments

* fix(shell): fix heredoc indentation in x-sonarcloud

* feat(python): add ruff linter and formatter configuration

* fix(ci): align megalinter config with biome, ruff, and shfmt settings

* fix(ci): disable black and yaml-prettier in megalinter config

* chore(ci): update ruff-pre-commit to v0.15.0 and fix hook name

* fix(scripts): check for .git dir before skipping clone in install-fonts

* fix(shell): address code review issues in scripts and shared.sh

- Guard wezterm show-keys failure in create-wezterm-keymaps.sh
- Stop masking git failures with return 0 in install-cheat-purebashbible.sh
- Add missing shared.sh source in install-xcode-cli-tools.sh
- Replace exit 1 with return 1 in sourced shared.sh

* fix(scripts): address code review and security findings

- Guard wezterm show-keys failure in create-wezterm-keymaps.sh
- Stop masking git failures with return 0 in install-cheat-purebashbible.sh
- Add missing shared.sh source in install-xcode-cli-tools.sh
- Replace exit 1 with return 1 in sourced shared.sh
- Remove shell=True subprocess calls in x-git-largest-files.py

* style(shell): apply shfmt formatting and add args to pre-commit hook

* fix(python): suppress bandit false positives in x-git-largest-files

* fix(python): add nosemgrep suppression for check_output call

* feat(format): add prettier for YAML formatting

Install prettier, add .prettierrc.json config (200-char width, 2-space
indent, LF endings), .prettierignore, yarn scripts (lint:prettier,
fix:prettier, format:yaml), and pre-commit hook scoped to YAML files.

* style(yaml): apply prettier formatting

* fix(scripts): address remaining code review findings

- Python: use list comprehension to filter empty strings instead of
  slicing off the last element
- create-wezterm-keymaps: write to temp file and mv for atomic updates
- install-xcode-cli-tools: fix shellcheck source directive path

* fix(python): sort imports alphabetically in x-git-largest-files

* fix(lint): disable PYTHON_ISORT in MegaLinter, ruff handles it

* chore(git): add __pycache__ to gitignore

* fix(python): rename ambiguous variable l to line (E741)

* style: remove trailing whitespace and blank lines

* style(fzf): apply shfmt formatting

* style(shell): apply shfmt formatting

* docs(plans): add design documents

* style(docs): add language specifier to fenced code block

* feat(lint): add markdown-table-formatter to dev tooling

Add markdown-table-formatter as a dev dependency with yarn scripts
(lint:md-table, fix:md-table) and a local pre-commit hook to
automatically format markdown tables on commit.

config/shared.sh

@@ -5,7 +5,7 @@
 # shellcheck shell=bash
 
 # Defaults
-[ -z "$DOTFILES" ] && export DOTFILES="$HOME/.dotfiles"
+[[ -z "$DOTFILES" ]] && export DOTFILES="$HOME/.dotfiles"
 DOTFILES_CURRENT_SHELL=$(basename "$SHELL")
 export DOTFILES_CURRENT_SHELL
 
@@ -15,7 +15,7 @@ VERBOSE="${VERBOSE:-0}"
 DEBUG="${DEBUG:-0}"
 
 # Enable debugging with DEBUG=1
-[ "${DEBUG:-0}" -eq 1 ] && set -x
+[[ "${DEBUG:-0}" -eq 1 ]] && set -x
 
 # Detect the current shell
 CURRENT_SHELL=$(ps -p $$ -ocomm= | awk -F/ '{print $NF}')
@@ -33,9 +33,10 @@ x-path-prepend()
       ;;
     *)
       echo "Unsupported shell: $CURRENT_SHELL"
-      exit 1
+      return 1
       ;;
   esac
+  return 0
 }
 
 # Function to set environment variables based on the shell
@@ -52,9 +53,10 @@ x-set-env()
       ;;
     *)
       echo "Unsupported shell: $CURRENT_SHELL"
-      exit 1
+      return 1
       ;;
   esac
+  return 0
 }
 
 # Explicitly set XDG folders, if not already set
@@ -74,7 +76,7 @@ x-path-prepend "$DOTFILES/local/bin"
 x-path-prepend "$XDG_BIN_HOME"
 
 # Custom completion paths
-[ -z "$ZSH_CUSTOM_COMPLETION_PATH" ] && export ZSH_CUSTOM_COMPLETION_PATH="$XDG_CONFIG_HOME/zsh/completion"
+[[ -z "$ZSH_CUSTOM_COMPLETION_PATH" ]] && export ZSH_CUSTOM_COMPLETION_PATH="$XDG_CONFIG_HOME/zsh/completion"
 x-dc "$ZSH_CUSTOM_COMPLETION_PATH"
 export FPATH="$ZSH_CUSTOM_COMPLETION_PATH:$FPATH"
 
@@ -83,7 +85,8 @@ if ! declare -f msg > /dev/null; then
   # $1 - message (string)
   msg()
   {
-    [ "$VERBOSE" -eq 1 ] && msgr msg "$1"
+    local message="$1"
+    [[ "$VERBOSE" -eq 1 ]] && msgr msg "$message"
     return 0
   }
   msg "msg was not defined, defined it now"
@@ -95,7 +98,8 @@ if ! declare -f msg_err > /dev/null; then
   # $1 - error message (string)
   msg_err()
   {
-    msgr err "$1" >&2
+    local message="$1"
+    msgr err "$message" >&2
     exit 1
   }
 fi
@@ -106,7 +110,8 @@ if ! declare -f msg_done > /dev/null; then
   # $1 - message (string)
   msg_done()
   {
-    msgr "done" "$1"
+    local message="$1"
+    msgr "done" "$message"
     return 0
   }
 fi
@@ -117,7 +122,8 @@ if ! declare -f msg_run > /dev/null; then
   # $1 - message (string)
   msg_run()
   {
-    msgr run "$1"
+    local message="$1"
+    msgr run "$message"
     return 0
   }
 fi
@@ -128,7 +134,8 @@ if ! declare -f msg_ok > /dev/null; then
   # $1 - message (string)
   msg_ok()
   {
-    msgr ok "$1"
+    local message="$1"
+    msgr ok "$message"
     return 0
   }
 fi
@@ -143,12 +150,16 @@ if ! declare -f array_diff > /dev/null; then
   # Source: https://stackoverflow.com/a/42399479/594940
   array_diff()
   {
+    local result_var="$1"
+    local arr1_name="$2"
+    local arr2_name="$3"
     # shellcheck disable=SC1083,SC2086
-    eval local ARR1=\(\"\${$2[@]}\"\)
+    eval local ARR1=\(\"\${${arr1_name}[@]}\"\)
     # shellcheck disable=SC1083,SC2086
-    eval local ARR2=\(\"\${$3[@]}\"\)
+    eval local ARR2=\(\"\${${arr2_name}[@]}\"\)
     local IFS=$'\n'
-    mapfile -t "$1" < <(comm -23 <(echo "${ARR1[*]}" | sort) <(echo "${ARR2[*]}" | sort))
+    mapfile -t "$result_var" < <(comm -23 <(echo "${ARR1[*]}" | sort) <(echo "${ARR2[*]}" | sort))
+    return 0
   }
 fi