test(self-tests): refuse a fake script with an env shebang

docs/3-development.md

@@ -24,7 +24,10 @@ Every tool and hook has a `--self-test` that runs offline: no network, no `gh` l
 in temporary repos, `gh` stubbed where a command needs it, and fixtures from `scripts/fixtures/`.
 A change to a script extends its self-test first and watches it fail, then makes it pass. A new
 script goes into `tests/self-tests.sh`'s `sh_tests` or `py_tests` list, which is the one list
-both `just quality` and the flake's `self-tests` check read.
+both `just quality` and the flake's `self-tests` check read. A fake script a self-test writes
+starts with `#!$BASH` (a Python one runs under `sys.executable`), never `#!/usr/bin/env`: the
+flake's sandbox has no `/usr/bin/env`, so such a fake passes locally and fails in CI, and
+`tests/self-tests.sh` refuses it.
 
 A self-test that creates git repos starts with
 `unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_PREFIX GIT_COMMON_DIR` and

tests/self-tests.sh

@@ -27,5 +27,18 @@ t() {   # </dev/null: a self-test that falls through to a stdin read must fail,
 }
 for s in "${sh_tests[@]}"; do t bash "$s"; done
 for p in "${py_tests[@]}"; do t python3 "$p"; done
+
+# A fake written with an env shebang passes here and never runs in nix flake check's sandbox, which
+# has no /usr/bin/env (#61, #81, #83): fakes start with #!$BASH. `en[v]` keeps this file off its own list.
+env_shebangs() { grep -rnHE '#!/usr/bin/en[v]' "$@" --include='*.sh' --include='*.py' 2>/dev/null | grep -vE '^[^:]+:1:'; }
+fx="$(mktemp -d)"; trap 'rm -rf "$log" "$fx"' EXIT
+printf '#!/usr/bin/%s bash\ncat >fake <<EOF\n#!/usr/bin/%s bash\nEOF\n' env env >"$fx/red.sh"
+printf '#!/usr/bin/%s bash\ncat >fake <<EOF\n%s\nEOF\n' env "#!\$BASH" >"$fx/green.sh"
+if [ "$(env_shebangs "$fx/red.sh" | wc -l)" -eq 1 ] && [ -z "$(env_shebangs "$fx/green.sh")" ]; then
+  echo "ok    env-shebang check (fixtures)"
+else failed=$((failed + 1)); echo "FAIL  env-shebang check: its fixtures were judged wrong"; fi
+if offenders="$(env_shebangs scripts plugins tests)"; then
+  failed=$((failed + 1)); echo "FAIL  a fake with an env shebang (use #!\$BASH, or sys.executable in Python):"; sed 's/^/      /' <<<"$offenders"
+else echo "ok    no env-shebang fakes"; fi
 [ "$failed" -eq 0 ] || { echo "self-tests: $failed failed" >&2; exit 1; }
 echo "self-tests: all ok"