From 618b1116f869ac8c47ae5af1d694423853b988fe Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sat, 6 Sep 2025 23:51:12 +0200
Subject: [PATCH] tests(check): add support for global exclusion.

---
 tests/check.sh | 42 ++++++++++++++++++++++++++++++++++--------
 1 file changed, 34 insertions(+), 8 deletions(-)

diff --git a/tests/check.sh b/tests/check.sh
index 861ca84fa..5b35f8816 100644
--- a/tests/check.sh
+++ b/tests/check.sh
@@ -15,6 +15,8 @@ APPARMORD=${CHECK_APPARMORD:-apparmor.d}
 SBIN_LIST=${CHECK_SBIN_LIST:-tests/sbin.list}
 declare WITH_CHECK
 declare _check_is_disabled
+declare _check_is_disabled_global
+_FILE_IGNORE_ALL=false
 readonly APPARMORD SBIN_LIST RES MAX_JOBS
 readonly reset="\033[0m" fgRed="\033[0;31m" fgYellow="\033[0;33m" fgWhite="\033[0;37m" BgWhite="\033[1;37m"
 _msg() { printf '%b%s%b\n' "$BgWhite" "$*" "$reset"; }
@@ -44,6 +46,11 @@ _in_array() {
 _is_enabled() {
     local check="$1"
     if _in_array "$check" "${WITH_CHECK[@]}"; then
+        if [[ -n "${_check_is_disabled_global+x}" && ${#_check_is_disabled_global[@]} -gt 0 ]]; then
+            if _in_array "$check" "${_check_is_disabled_global[@]}"; then
+                return 1
+            fi
+        fi
         if [[ -z "${_check_is_disabled+x}" || ${#_check_is_disabled[@]} -eq 0 ]]; then
             return 0
         fi
@@ -70,10 +77,18 @@ _ignore_lint() {
     local checks line="$1"
 
     if [[ "$line" =~ ^[[:space:]]*$_IGNORE_LINT=.*$ ]]; then
-        # Start of an ignore block
-        _IGNORE_LINT_BLOCK=true
+        # Start of an ignore block (or file-wide if in header)
         checks="${line#*"$_IGNORE_LINT="}"
-        read -ra _check_is_disabled <<<"${checks//,/ }"
+        read -ra _parsed <<<"${checks//,/ }"
+        if (( line_number <= 10 )); then
+            # Treat as file-wide ignore
+            _check_is_disabled_global=("${_parsed[@]}")
+            _FILE_IGNORE_ALL=true
+            _IGNORE_LINT_BLOCK=false
+            return 0
+        fi
+        _IGNORE_LINT_BLOCK=true
+        _check_is_disabled=("${_parsed[@]}")
 
     elif [[ $_IGNORE_LINT_BLOCK == true && "$line" =~ ^[[:space:]]*$ ]]; then
         # New paragraph, end of block
@@ -81,22 +96,33 @@ _ignore_lint() {
         _check_is_disabled=()
 
     elif [[ $_IGNORE_LINT_BLOCK == true ]]; then
-        # Nothing to do, we are in a block
+        # Nothing to do, we are in a block/paragraph
         return 0
 
     elif [[ "$line" == *"$_IGNORE_LINT="* ]]; then
-        # Inline ignore
+        # Inline ignore (or file-wide if in header)
         checks="${line#*"$_IGNORE_LINT="}"
-        read -ra _check_is_disabled <<<"${checks//,/ }"
+        read -ra _parsed <<<"${checks//,/ }"
+        if (( line_number <= 10 )); then
+            _check_is_disabled_global=("${_parsed[@]}")
+            _FILE_IGNORE_ALL=true
+            return 0
+        fi
+        _check_is_disabled=("${_parsed[@]}")
 
     else
-        _check_is_disabled=()
+        # Do not clear if file-wide ignore is set
+        if ! $_FILE_IGNORE_ALL; then
+            _check_is_disabled=()
+        fi
     fi
 }
 
 _check() {
     local file="$1"
-    local line_number=0
+    line_number=0
+    _FILE_IGNORE_ALL=false
+    _check_is_disabled_global=()
 
     while IFS= read -r line; do
         line_number=$((line_number + 1))