dbeaver-bin: make update script safer, apply shellcheck

When downloading one of the artifacts fail, the hash doesn't get updated
and the previous artifact's hash was written.
In this case the script should fail.

pkgs/by-name/db/dbeaver-bin/update.sh

@@ -2,6 +2,8 @@
 #!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts
 BASEDIR="$(dirname "$0")/../../../.."
 
+set -euo pipefail
+
 latestVersion=$(curl "https://api.github.com/repos/dbeaver/dbeaver/tags" | jq -r '.[0].name')
 currentVersion=$(nix-instantiate --eval -E "with import ${BASEDIR} {}; lib.getVersion dbeaver-bin" | tr -d '"')
 
@@ -19,9 +21,10 @@ for i in \
     "x86_64-darwin macos-x86_64.dmg" \
     "aarch64-darwin macos-aarch64.dmg"
 do
+    # shellcheck disable=SC2086 # $i is intentionally splitted to $1 and $2
     set -- $i
     prefetch=$(nix-prefetch-url "https://github.com/dbeaver/dbeaver/releases/download/$latestVersion/dbeaver-ce-$latestVersion-$2")
-    hash=$(nix-hash --type sha256 --to-sri $prefetch)
+    hash=$(nix-hash --type sha256 --to-sri "$prefetch")
 
-    (cd "$BASEDIR" && update-source-version dbeaver-bin $latestVersion $hash --system=$1 --ignore-same-version)
+    (cd "$BASEDIR" && update-source-version dbeaver-bin "$latestVersion" "$hash" --system="$1" --ignore-same-version)
 done