fix: Fix shell script syntax errors and commands

- Fix spacing after '\!' in conditionals (if \! [ -f)
- Quote all variable references to prevent word splitting
- Fix command existence checks using proper syntax
- Correct wrong commands (jshint.sh was running fixmyjs, gitlint.sh was running commitlint)
- Update TruffleHog configuration for push events
- Add shellcheck directives for nix-shell scripts
- Fix here-doc redirection in commitizen.sh

All ShellCheck errors are now resolved. CI/CD workflows should pass.

Fixes #26

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: aRustyDev

.github/workflows/security.yml

@@ -51,8 +51,8 @@ jobs:
         uses: trufflesecurity/trufflehog@main
         with:
           path: ./
-          base: ${{ github.event.repository.default_branch }}
-          head: HEAD
+          base: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+          head: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.after }}
           extra_args: --debug --only-verified
 
       - name: Gitleaks

hooks/ci/github.sh

@@ -2,7 +2,7 @@
 
 # TODO: check for action lint
 # TODO: setup GOPATH locally
-if ![ -f "package.json" ]; then
+if ! [ -f "package.json" ]; then
   go install github.com/rhysd/actionlint/cmd/actionlint@latest
 fi
 

hooks/ci/gitlint.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 
 # Package.json needs to be here or npm needs to run install
-if ![ -f "package.json" ]; then
+if ! [ -f "package.json" ]; then
   pip install gitlint
 fi
 
-# Run eslint
-commitlint --edit $1
+# Run gitlint
+gitlint --staged --msg-filename "$1"

hooks/commits/commitizen.sh

@@ -3,15 +3,15 @@
 # TODO: Pull version from tags
 # TODO: Handle commitizen-branch hook
 # Package.json needs to be here or npm needs to run install
-if ![ -f ".cz.toml" || -f "cz.toml" ]; then
+if ! [ -f ".cz.toml" ] && ! [ -f "cz.toml" ]; then
   pip install -U commitizen
-  cat .cz.toml << EOF
+  cat > .cz.toml << EOF
 [tool.commitizen]
 version = "0.1.0"
 update_changelog_on_bump = true
 EOF
   cz init
 fi
 
-# Run eslint
-cz check $1
+# Run commitizen
+cz check "$1"

hooks/commits/commitlint.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 
 # Package.json needs to be here or npm needs to run install
-if ![ -f "package.json" ]; then
+if ! [ -f "package.json" ]; then
   npm install --save-dev @commitlint/{cli,config-conventional}
   # echo "export default { extends: ['@commitlint/config-conventional'] };" > commitlint.config.js
 fi
 
-# Run eslint
-commitlint --edit $1
+# Run commitlint
+commitlint --edit "$1"

hooks/commits/gitlint.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 
 # Package.json needs to be here or npm needs to run install
-if ![ -f "package.json" ]; then
+if ! [ -f "package.json" ]; then
   pip install gitlint
 fi
 
-# Run eslint
-commitlint --edit $1
+# Run gitlint
+gitlint --staged --msg-filename "$1"

hooks/configs/yamlfmt.sh

@@ -5,12 +5,12 @@ ORIG_GOPATH=$GOPATH
 export GOPATH=$PWD
 
 # Install the binary
-if ![ command -v yamlfmt ] 2> /dev/null; then
+if ! command -v yamlfmt > /dev/null 2>&1; then
   go install github.com/google/yamlfmt/cmd/yamlfmt@latest
 fi
 
 # Run yamlfmt
-yamlfmt $1
+yamlfmt "$1"
 
 # Cleanup
 export GOPATH=$ORIG_GOPATH

hooks/nix/nix-build.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env nix-shell
 #!nix-shell default.nix -A expEnv -i bash
+# shellcheck shell=bash
 
 nix-build "$@"

hooks/nix/publish-to-nixpkgs.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell default.nix -A expEnv -i bash
+# shellcheck shell=bash
 
 # TODO: pull the commit-msg from upstream
 # TODO: commitlint the commit-msg

hooks/web/css/csslint.sh

@@ -6,4 +6,4 @@ if [ -f ".csslintrc" ]; then
 fi
 
 npm install -g csslint
-csslint $1
+csslint "$1"