rework: fix all vulnerabilities

package/hemar/parser/default.nix

@@ -8,13 +8,14 @@ let
 
   hemar = hectic.writeShellApplication {
     inherit shell bashOptions;
+    excludeShellChecks = [ "SC1091" ];
     name = "hemar";
     runtimeInputs = [ yq-go ];
 
     text = ''
       # shellcheck disable=SC2034
       WORKSPACE=${./.}
-      ${builtins.readFile hectic.helpers.posix-shell.log}
+      . ${hectic.helpers.posix-shell.log}/bin/log.sh
       ${builtins.readFile ./hemar.sh}
     '';
   };

package/hemar/parser/hemar.sh

@@ -299,7 +299,7 @@ parse_tag() {
           log trace "tag in ws -> type: \`${TAG_type:-}\`"
           case "${TAG_type:-unknown}" in
             unknown) finalize_first_arg ;;
-            for) 
+            'for')
               # NOTE: 
               # grammar: for i in key."subkey" ; so we know
               # 1st argument after `for` - string (name of variable)
@@ -427,13 +427,13 @@ finish() {
     unknown) 
       finish_interpolation_tag
     ;;
-    done)
+    'done')
       finish_done_tag
     ;;
     '{[')
       finish_bracket_tag
     ;;
-    for) ;;
+    'for') ;;
     *) log panic 'unexpected TAG_type on finish'; exit 13; ;;
   esac
 }
@@ -442,14 +442,14 @@ finalize_first_arg() {
   log trace "finalize first arg"
   log trace "buffer: $(cat "$CURRENT_STAGE_BUFFER")"
   case "$(cat "$CURRENT_STAGE_BUFFER")" in
-    for)
+    'for')
       TAG_type='for'
       # NOTE: we know that next argument after `for` is string
       TAG_grammar_mode=string
       log error 'for unimplemented'
       exit 13
     ;;
-    done)
+    'done')
       finish_done_tag
     ;;
     '{[')
@@ -651,4 +651,4 @@ if [ -z "${AS_LIBRARY+x}" ]; then
   # return the output
   # shellcheck disable=SC2086
   yq ${OUTPUT_ARGS:-} -o j "$AST"
-fi
+fi