style: silence false-positive lint warnings

Inline directives for cases where the linter's shell/language dialect
doesn't match reality:
- init.lua: _G.P helper is intentional
- dot_zprofile: zsh tied arrays, $+commands, optional sourcing
- dot_zshrc: zsh brace-group-as-function-body
- ipython_config: 'c' is injected by IPython at load time
- doasedit: /bin/sh on Arch is bash, -O test is supported

4 files changed, 8 insertions, 1 deletions

diff --git a/dot_config/ipython/profile_default/ipython_config.py b/dot_config/ipython/profile_default/ipython_config.py
index 1ff9f35..4a3052b 100644
--- a/dot_config/ipython/profile_default/ipython_config.py
+++ b/dot_config/ipython/profile_default/ipython_config.py
@@ -1,3 +1,4 @@
+# ruff: noqa: F821  # `c` is injected by IPython at config load time
 c.InteractiveShell.banner1 = ""
 c.InteractiveShell.colors = "Linux"
 c.InteractiveShell.enable_html_pager = True
diff --git a/dot_config/nvim/init.lua b/dot_config/nvim/init.lua
index fc3271b..82bcda0 100644
--- a/dot_config/nvim/init.lua
+++ b/dot_config/nvim/init.lua
@@ -1,5 +1,6 @@
 require("config.options")
 
+-- selene: allow(global_usage)
 _G.P = function(v)
   print(vim.inspect(v))
   return v
diff --git a/dot_config/zsh/dot_zprofile b/dot_config/zsh/dot_zprofile
index 30b5b21..32b9245 100644
--- a/dot_config/zsh/dot_zprofile
+++ b/dot_config/zsh/dot_zprofile
@@ -7,6 +7,7 @@ __ZPROFILE_SOURCED=1
 
 # ── PATH ──────────────────────────────────────────────────────────────────────
 typeset -U path  # deduplicate PATH entries
+# shellcheck disable=SC2206  # zsh tied array; no word-splitting concerns
 path=("$HOME/.local/bin" "$HOME/.local/share/nvim/mason/bin" $path)
 
 # ── XDG Base Directories ─────────────────────────────────────────────────────
@@ -40,7 +41,8 @@ export LESS="-F --RAW-CONTROL-CHARS"
 
 # ── GPG / SSH ─────────────────────────────────────────────────────────────────
 unset SSH_AGENT_PID
-export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
+SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
+export SSH_AUTH_SOCK
 
 # ── FZF ───────────────────────────────────────────────────────────────────────
 export FZF_DEFAULT_COMMAND="fd --type file --follow --hidden --exclude .git --color=always"
@@ -102,11 +104,13 @@ case $(uname -n) in
         ;;
     hercules)
         export OCL_ICD_VENDORS=nvidia
+    # shellcheck disable=SC1091  # optional, loaded only on hosts that have it
         [[ -r "$XDG_CONFIG_HOME/sh/work-envrc" ]] && source "$XDG_CONFIG_HOME/sh/work-envrc"
         ;;
 esac
 
 # ── Secrets (from pass) ──────────────────────────────────────────────────────
+# shellcheck disable=SC2154,SC2155  # zsh $+commands / $( ) export idiom
 (( $+commands[pass] )) && export FIRECRAWL_API_KEY="$(pass show copilot/firecrawl-api-key)"
 
 # ── Auto-start sway on VT1 ────────────────────────────────────────────────────
diff --git a/dot_config/zsh/dot_zshrc b/dot_config/zsh/dot_zshrc
index dd5a82d..7bb6010 100644
--- a/dot_config/zsh/dot_zshrc
+++ b/dot_config/zsh/dot_zshrc
@@ -64,6 +64,7 @@ _comp_options+=(globdots)  # include hidden files in completion
 # Without this, some terminals send wrong sequences for special keys.
 if (( ${+terminfo[smkx]} && ${+terminfo[rmkx]} )); then
 	autoload -Uz add-zle-hook-widget
+	# shellcheck disable=all  # zsh brace-group-as-function-body isn't bash syntax
 	function zle_application_mode_start { echoti smkx }
 	function zle_application_mode_stop  { echoti rmkx }
 	add-zle-hook-widget -Uz zle-line-init zle_application_mode_start