From fac375256d6a3154408d03982a43a1e0104c1545 Mon Sep 17 00:00:00 2001
From: Victor Engmark <victor@engmark.name>
Date: Sun, 12 Jan 2025 09:41:41 +0100
Subject: [PATCH 1/2] nixos/renovate: Fix ShellCheck issue

Tracking issue #349572.
---
 nixos/modules/services/misc/renovate.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/misc/renovate.nix b/nixos/modules/services/misc/renovate.nix
index cc1185fb0580..5d968dc41a68 100644
--- a/nixos/modules/services/misc/renovate.nix
+++ b/nixos/modules/services/misc/renovate.nix
@@ -138,9 +138,10 @@ in
 
       script = ''
         ${lib.concatStringsSep "\n" (
-          builtins.map (name: "export ${name}=$(systemd-creds cat 'SECRET-${name}')") (
-            lib.attrNames cfg.credentials
-          )
+          builtins.map (name: ''
+            ${name}="$(systemd-creds cat 'SECRET-${name}')"
+            export ${name}
+          '') (lib.attrNames cfg.credentials)
         )}
         exec ${lib.escapeShellArg (lib.getExe cfg.package)}
       '';

From 9ec8ebf5ffbd9d18a56ace1781092149159b2848 Mon Sep 17 00:00:00 2001
From: Victor Engmark <victor@engmark.name>
Date: Sun, 12 Jan 2025 13:09:16 +0100
Subject: [PATCH 2/2] nixos/renovate: Add note about linting systemd scripts

---
 nixos/tests/renovate.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/tests/renovate.nix b/nixos/tests/renovate.nix
index 4bfdab4edec3..52bcc867173c 100644
--- a/nixos/tests/renovate.nix
+++ b/nixos/tests/renovate.nix
@@ -31,6 +31,8 @@ import ./make-test-python.nix (
           enable = true;
           settings.server.HTTP_PORT = 3000;
         };
+        # Uncomment the next line to lint service scripts (Note: breaks VM startup; see #373166)
+        #systemd.enableStrictShellChecks = true;
       };
 
     testScript = ''