infra/deploy/render-secrets.sh

@@ -330,6 +330,11 @@ EMIT
     # environment, `set -a`, no inherited variables to mask a dropped key — and
     # read every value back out. This is the test that the file cannot pass while
     # carrying the 2026-07-24 bug, and it runs on every render, not once.
+    # shellcheck disable=SC2016  # single quotes are the point: "$1" must be
+    # expanded by the inner `bash -c`, against the argument passed after `_`,
+    # not by this shell. Double-quoting would interpolate the OUTER $1 — the
+    # function's own first argument, the repo root — and the check would then
+    # verify the wrong file, or nothing at all, while still reporting success.
     env -i PATH="$PATH" bash -c \
       'set -a; . "$1"; set +a; exec python3 -c "
 import json, os, sys

infra/deploy/secrets/verify-centralis-render.sh

@@ -30,6 +30,10 @@ VAULT="deploy/secrets/centralis.${ENV_NAME}.yaml"
 SSH=(ssh -i "$SSH_KEY" "$SSH_TARGET")
 SCP=(scp -q -i "$SSH_KEY")
 
+# shellcheck disable=SC2016  # single quotes are required: this whole string is
+# executed by the REMOTE shell, so $d and the command substitution must survive
+# the trip intact. Double-quoting would run mktemp locally and then send a path
+# that does not exist on the host.
 scratch="$("${SSH[@]}" 'd=$(mktemp -d) && chmod 700 "$d" && mkdir -p "$d/deploy/secrets" && echo "$d"')"
 [ -n "$scratch" ] || { echo "!! could not create a scratch dir on the host" >&2; exit 1; }
 cleanup() { "${SSH[@]}" "rm -rf -- '$scratch'" >/dev/null 2>&1 || true; }