Enforce /usr/bin/env shebangs in userscripts

See https://github.com/qutebrowser/qutebrowser/discussions/5927#discussioncomment-145322

3 files changed, 26 insertions, 3 deletions

diff --git a/misc/userscripts/format_json b/misc/userscripts/format_json
index 541408c70..8a83c25fa 100755
--- a/misc/userscripts/format_json
+++ b/misc/userscripts/format_json
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 #
 # Behavior:
diff --git a/misc/userscripts/qr b/misc/userscripts/qr
index 6b935beda..84215249b 100755
--- a/misc/userscripts/qr
+++ b/misc/userscripts/qr
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 pngfile=$(mktemp --suffix=.png)
 trap 'rm -f "$pngfile"' EXIT
diff --git a/scripts/dev/misc_checks.py b/scripts/dev/misc_checks.py
index 14373f94f..7b9ce769b 100644
--- a/scripts/dev/misc_checks.py
+++ b/scripts/dev/misc_checks.py
@@ -274,12 +274,35 @@ def check_userscripts_descriptions(_args: argparse.Namespace = None) -> bool:
     return ok
 
 
+def check_userscript_shebangs(_args: argparse.Namespace) -> bool:
+    """Check that we're using /usr/bin/env in shebangs."""
+    ok = True
+    folder = pathlib.Path('misc/userscripts')
+
+    for sub in folder.iterdir():
+        if sub.is_dir() or sub.name == 'README.md':
+            continue
+
+        with sub.open('r', encoding='utf-8') as f:
+            shebang = f.readline()
+        assert shebang.startswith('#!'), shebang
+        binary = shebang.split()[0][2:]
+
+        if binary not in ['/bin/sh', '/usr/bin/env']:
+            bin_name = pathlib.Path(binary).name
+            print(f"In {sub}, use #!/usr/bin/env {bin_name} instead of #!{binary}")
+            ok = False
+
+    return ok
+
+
 def main() -> int:
     checkers = {
         'git': check_git,
         'vcs': check_vcs_conflict,
         'spelling': check_spelling,
-        'userscripts': check_userscripts_descriptions,
+        'userscript-descriptions': check_userscripts_descriptions,
+        'userscript-shebangs': check_userscript_shebangs,
         'changelog-urls': check_changelog_urls,
     }