From ae1a7771b169711f48376c0f9b1c7601eb4798bf Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Sun, 11 Oct 2026 16:33:20 -0700
Subject: [PATCH 1/2] ci: use shallow clone to install bats from source

When installing bats from source (in Dockerfile and setup_host.sh),
do a shallow clone of the needed tag, rather than cloning the whole
repo and then checking out the tag.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 Dockerfile           |  3 +--
 script/setup_host.sh | 17 +++++------------
 2 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 2866da694..18098a5bd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -53,9 +53,8 @@ RUN useradd -u1000 -m -d/home/rootless -s/bin/bash rootless
 # install bats
 ARG BATS_VERSION
 RUN cd /tmp \
-    && git clone https://github.com/bats-core/bats-core.git \
+    && git clone --depth 1 --branch "${BATS_VERSION}" https://github.com/bats-core/bats-core.git \
     && cd bats-core \
-    && git reset --hard "${BATS_VERSION}" \
     && ./install.sh /usr/local \
     && rm -rf /tmp/bats-core
 
diff --git a/script/setup_host.sh b/script/setup_host.sh
index 9cd317d2c..d280c0ec0 100755
--- a/script/setup_host.sh
+++ b/script/setup_host.sh
@@ -55,23 +55,16 @@ fi
 # Install BATS
 if [ "$PLATFORM_ID" = "platform:el8" ]; then
 	# The packaged version of bats is too old: `BATS_ERROR_SUFFIX: unbound variable`, `bats_require_minimum_version: command not found`
-	(
-		cd /tmp
-		git clone https://github.com/bats-core/bats-core
-		(
-			cd bats-core
-			git checkout "$BATS_VERSION"
-			./install.sh /usr/local
-			cat >>/etc/profile.d/sh.local <<'EOF'
+	git clone --depth 1 --branch "$BATS_VERSION" https://github.com/bats-core/bats-core /tmp/bats-core
+	/tmp/bats-core/install.sh /usr/local
+	rm -rf /tmp/bats-core
+	cat >>/etc/profile.d/sh.local <<'EOF'
 PATH="/usr/local/bin:$PATH"
 export PATH
 EOF
-			cat >/etc/sudoers.d/local <<'EOF'
+	cat >/etc/sudoers.d/local <<'EOF'
 Defaults    secure_path = "/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
 EOF
-		)
-		rm -rf bats-core
-	)
 else
 	"${DNF[@]}" install bats
 fi

From f4100076724d5fdbaf1f08da8753ab009a149bcf Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Sun, 11 Oct 2026 16:33:20 -0700
Subject: [PATCH 2/2] ci: install bats to /usr

Install bats to /usr rather than /usr/local, so we no longer need to add
/usr/local/bin to PATH and sudo's secure_path in script/setup_host.sh.

For Dockerfile, it makes no difference (because Debian comes with
/usr/local preconfigured for both PATH and sudo), but do the same change
for uniformity.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 Dockerfile           | 2 +-
 script/setup_host.sh | 9 +--------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 18098a5bd..bfe0a6cba 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -55,7 +55,7 @@ ARG BATS_VERSION
 RUN cd /tmp \
     && git clone --depth 1 --branch "${BATS_VERSION}" https://github.com/bats-core/bats-core.git \
     && cd bats-core \
-    && ./install.sh /usr/local \
+    && ./install.sh /usr \
     && rm -rf /tmp/bats-core
 
 ARG RELEASE_ARCHES="386 amd64 arm64 armel armhf ppc64le riscv64 s390x"
diff --git a/script/setup_host.sh b/script/setup_host.sh
index d280c0ec0..b0a8ba030 100755
--- a/script/setup_host.sh
+++ b/script/setup_host.sh
@@ -56,15 +56,8 @@ fi
 if [ "$PLATFORM_ID" = "platform:el8" ]; then
 	# The packaged version of bats is too old: `BATS_ERROR_SUFFIX: unbound variable`, `bats_require_minimum_version: command not found`
 	git clone --depth 1 --branch "$BATS_VERSION" https://github.com/bats-core/bats-core /tmp/bats-core
-	/tmp/bats-core/install.sh /usr/local
+	/tmp/bats-core/install.sh /usr
 	rm -rf /tmp/bats-core
-	cat >>/etc/profile.d/sh.local <<'EOF'
-PATH="/usr/local/bin:$PATH"
-export PATH
-EOF
-	cat >/etc/sudoers.d/local <<'EOF'
-Defaults    secure_path = "/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
-EOF
 else
 	"${DNF[@]}" install bats
 fi