ci: fix mkosi REUSE and shell checks

Author: kvinwang

REUSE.toml

@@ -174,6 +174,14 @@ precedence = "override"
 
 # Generated files
 
+# Experimental Debian/mkosi guest OS backend. Some native configuration
+# formats (JSON, apt, kernel config and gitignore) cannot carry SPDX headers.
+[[annotations]]
+path = "os/mkosi/**"
+SPDX-FileCopyrightText = "© 2026 Phala Network <dstack@phala.network>"
+SPDX-License-Identifier = "Apache-2.0"
+precedence = "override"
+
 [[annotations]]
 path = "dstack/kms/auth-eth/typechain-types/**"
 SPDX-FileCopyrightText = "NONE"

os/mkosi/.gitignore

@@ -2,4 +2,3 @@ build*/
 repro*/
 *.raw
 *.raw.zst
-

os/mkosi/build.sh

@@ -3,6 +3,7 @@
 set -euo pipefail
 SELF=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 ROOT=$(cd "$SELF/../.." && pwd)
+# shellcheck source=/dev/null
 source "$SELF/versions.env"
 action=${1:-image}
 BUILD_DIR=${2:-$SELF/build}

os/mkosi/mkosi.skeleton/etc/apt/apt.conf.d/99dstack-reproducible

@@ -1,4 +1,3 @@
 Acquire::Check-Valid-Until "false";
 APT::Install-Recommends "false";
 APT::Install-Suggests "false";
-

os/mkosi/mkosi.skeleton/etc/docker/daemon.json

@@ -3,4 +3,3 @@
   "ip6tables": true,
   "storage-driver": "overlay2"
 }
-

os/mkosi/mkosi.skeleton/etc/ssh/sshd_config.d/10-dstack.conf

@@ -1,4 +1,3 @@
 PasswordAuthentication no
 KbdInteractiveAuthentication no
 PermitRootLogin prohibit-password
-

os/mkosi/mkosi.skeleton/etc/systemd/network/20-wired.network

@@ -4,4 +4,3 @@ Name=en* eth*
 [Network]
 DHCP=yes
 IPv6AcceptRA=yes
-

os/mkosi/mkosi.skeleton/etc/systemd/system/dstack-firstboot.service

@@ -9,4 +9,3 @@ RemainAfterExit=yes
 
 [Install]
 WantedBy=multi-user.target
-

os/mkosi/scripts/build-kernel.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
 MKOSI_DIR="$ROOT/os/mkosi"
-# shellcheck source=../versions.env
+# shellcheck source=/dev/null
 source "$MKOSI_DIR/versions.env"
 BUILD_DIR=${1:?build directory required}
 STAGING=${2:?staging tree required}

os/mkosi/scripts/build-ovmf.sh

@@ -30,6 +30,7 @@ sed -i -e 's/-flto/-fno-lto/g' -e 's/-DUSING_LTO//g' \
 sed -i 's/-Werror /-Werror -Wno-maybe-uninitialized -Wno-stringop-overflow /g' \
   "$src/BaseTools/Conf/tools_def.template"
 rm -f "$src/Conf/tools_def.txt"
+# shellcheck source=/dev/null
 (cd "$src" && set +u && source edksetup.sh BaseTools >/dev/null && \
   build -a X64 -t GCC5 -b RELEASE -n "${JOBS:-$(nproc)}" \
     -p OvmfPkg/IntelTdx/IntelTdxX64.dsc)