scripts: fix shellcheck SC2046 warnings

Fix SC2046: "Quote this to prevent word splitting."
Ref: https://www.shellcheck.net/wiki/SC2046

Also:
- shellcheck.sh: add `set -eu`.
- shellcheck.sh, yamlcheck.sh: always run from repo root.
- pass `--` before passing the list of files, where missing.
- badwords.pl, cleancmd.pl: rework to accept `git ls-files` arguments.
  Requires Perl 5.22+ (2015-Jun-01) on Windows.
  Ref: https://perldoc.perl.org/functions/open
- INTERNALS.md: require Perl 5.22 on Windows.
- spacecheck.pl: formatting.
- GHA/http3-linux: rework command to avoid SC2046.
- stop suppressing SC2046 warnings.

The yamlcheck.sh issue reported-by: Stanislav Fort (Aisle Research)
Ref: 20251109163515_6eb31da3-deb2-4f4d-8327-935904f27da5

Closes #19432

.github/scripts/badwords.pl

@@ -79,9 +79,11 @@ sub file {
     close(F);
 }
 
-my @files = @ARGV;
-
-foreach my $each (@files) {
+my @filemasks = @ARGV;
+open(my $git_ls_files, '-|', 'git', 'ls-files', '--', @filemasks) or die "Failed running git ls-files: $!";
+while(my $each = <$git_ls_files>) {
+    chomp $each;
     file($each);
 }
+close $git_ls_files;
 exit $errors;

.github/scripts/cleancmd.pl

@@ -119,6 +119,10 @@ sub process {
     }
 }
 
-for my $f (@ARGV) {
+my @filemasks = @ARGV;
+open(my $git_ls_files, '-|', 'git', 'ls-files', '--', @filemasks) or die "Failed running git ls-files: $!";
+while(my $f = <$git_ls_files>) {
+    chomp $f;
     process($f);
 }
+close $git_ls_files;

.github/scripts/codespell.sh

@@ -7,7 +7,7 @@ set -eu
 
 cd "$(dirname "${0}")"/../..
 
-# shellcheck disable=SC2046
+git ls-files -z | xargs -0 -r \
 codespell \
   --skip '.github/scripts/pyspelling.words' \
   --skip '.github/scripts/typos.toml' \
@@ -16,4 +16,4 @@ codespell \
   --skip 'scripts/wcurl' \
   --ignore-regex '.*spellchecker:disable-line' \
   --ignore-words '.github/scripts/codespell-ignore.words' \
-  $(git ls-files)
+  --

.github/scripts/shellcheck.sh

@@ -3,7 +3,11 @@
 #
 # SPDX-License-Identifier: curl
 
-# shellcheck disable=SC2046
-shellcheck --exclude=1091 \
+set -eu
+
+cd "$(dirname "${0}")"/../..
+
+git grep -z -l -E '^#!(/usr/bin/env bash|/bin/sh|/bin/bash)' | xargs -0 -r \
+shellcheck --exclude=1091,2248 \
   --enable=avoid-nullary-conditions,deprecate-which \
-  $(grep -l -E '^#!(/usr/bin/env bash|/bin/sh|/bin/bash)' $(git ls-files))
+  --

.github/scripts/spacecheck.pl

@@ -88,11 +88,11 @@ sub eol_detect {
 
 my $issues = 0;
 
-open my $git_ls_files, '-|', 'git ls-files' or die "Failed running git ls-files: $!";
+open(my $git_ls_files, '-|', 'git ls-files') or die "Failed running git ls-files: $!";
 while(my $filename = <$git_ls_files>) {
     chomp $filename;
 
-    open my $fh, '<', $filename or die "Cannot open '$filename': $!";
+    open(my $fh, '<', $filename) or die "Cannot open '$filename': $!";
     my $content = do { local $/; <$fh> };
     close $fh;
 

.github/scripts/yamlcheck.sh

@@ -5,9 +5,11 @@
 
 set -eu
 
-# shellcheck disable=SC2046
+cd "$(dirname "${0}")"/../..
+
+git ls-files '*.yaml' '*.yml' -z | xargs -0 -r \
 yamllint \
   --format standard \
   --strict \
-  --config-data "$(dirname "$0")/yamlcheck.yaml" \
-  $(git ls-files '*.yaml' '*.yml')
+  --config-data .github/scripts/yamlcheck.yaml \
+  --

.github/workflows/checkdocs.yml

@@ -66,10 +66,10 @@ jobs:
   #          JSON
   #
   #      - name: 'trim headers off all *.md files'
-  #        run: git ls-files -z '*.md' | xargs -0 -n1 .github/scripts/trimmarkdownheader.pl
+  #        run: git ls-files '*.md' -z | xargs -0 -n1 .github/scripts/trimmarkdownheader.pl
   #
   #      - name: 'check prose'
-  #        run: git ls-files -z '*.md' | grep -Evz 'CHECKSRC\.md|DISTROS\.md|curl_mprintf\.md|CURLOPT_INTERFACE\.md|interface\.md' | xargs -0 proselint -- README
+  #        run: git ls-files '*.md' -z | grep -Evz 'CHECKSRC\.md|DISTROS\.md|curl_mprintf\.md|CURLOPT_INTERFACE\.md|interface\.md' | xargs -0 proselint -- README
   #
   #      # This is for CHECKSRC and files with aggressive exclamation mark needs
   #      - name: 'create second proselint config'
@@ -109,9 +109,7 @@ jobs:
           persist-credentials: false
 
       - name: 'trim all *.md files in docs/'
-        run: |
-          # shellcheck disable=SC2046
-          .github/scripts/cleancmd.pl $(find docs -name '*.md')
+        run: .github/scripts/cleancmd.pl 'docs/*.md'
 
       - name: 'install'
         run: |
@@ -140,9 +138,7 @@ jobs:
           persist-credentials: false
 
       - name: 'badwords'
-        run: |
-          # shellcheck disable=SC2046
-          .github/scripts/badwords.pl < .github/scripts/badwords.txt $(git ls-files '**.md') docs/TODO docs/KNOWN_BUGS packages/OS400/README.OS400
+        run: .github/scripts/badwords.pl '**.md' docs/TODO docs/KNOWN_BUGS packages/OS400/README.OS400 < .github/scripts/badwords.txt
 
       - name: 'verify synopsis'
         run: .github/scripts/verify-synopsis.pl docs/libcurl/curl*.md

.github/workflows/checksrc.yml

@@ -164,7 +164,4 @@ jobs:
 
       # we allow some extra in source code
       - name: 'badwords'
-        run: |
-          # shellcheck disable=SC2046
-          grep -Ev '(\\bwill| url | dir )' .github/scripts/badwords.txt | \
-          .github/scripts/badwords.pl $(git ls-files -- src lib include)
+        run: grep -Ev '(\\bwill| url | dir )' .github/scripts/badwords.txt | .github/scripts/badwords.pl src lib include

.github/workflows/http3-linux.yml

@@ -587,8 +587,7 @@ jobs:
           cargo build -v --package quiche --release --features ffi,pkg-config-meta,qlog --verbose
           ln -s libquiche.so target/release/libquiche.so.0
           mkdir -v quiche/deps/boringssl/src/lib
-          # shellcheck disable=SC2046
-          ln -vnf $(find target/release -name libcrypto.a -o -name libssl.a) quiche/deps/boringssl/src/lib/
+          find target/release \( -name libcrypto.a -o -name libssl.a \) -exec ln -vnf '{}' quiche/deps/boringssl/src/lib \;
 
           # include dir
           # /home/runner/quiche/quiche/deps/boringssl/src/include

docs/INTERNALS.md

@@ -48,7 +48,7 @@ versions of libs and build tools.
  - GNU Autoconf 2.59
  - GNU Automake 1.7
  - GNU M4       1.4
- - perl         5.8
+ - perl         5.8 (5.22 on Windows)
  - roffit       0.5
  - cmake        3.7