From c8aaa5d2f21f9eba973f8cfac12621819502102f Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Wed, 15 Oct 2025 19:45:48 +0200
Subject: [PATCH] scripts: pass `--` before passing xargs

Also:
- GHA/checkdocs: escape `.` in -E regex expression.

Closes #19076
---
 .github/workflows/appveyor-status.yml | 2 +-
 .github/workflows/checkdocs.yml       | 2 +-
 scripts/cmakelint.sh                  | 3 ++-
 scripts/firefox-db2pem.sh             | 2 +-
 scripts/perlcheck.sh                  | 2 +-
 5 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/appveyor-status.yml b/.github/workflows/appveyor-status.yml
index 5269f3ca65..48e11b0e3d 100644
--- a/.github/workflows/appveyor-status.yml
+++ b/.github/workflows/appveyor-status.yml
@@ -29,7 +29,7 @@ jobs:
           APPVEYOR_REPOSITORY: ${{ github.event.repository.full_name }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo "${APPVEYOR_TARGET_URL}" | sed 's/\/project\//\/api\/projects\//' | xargs -t -n1 curl -s | \
+          echo "${APPVEYOR_TARGET_URL}" | sed 's/\/project\//\/api\/projects\//' | xargs -t -n1 curl -s -- | \
             jq -c '.build.jobs[] | {target_url: ($target_url + "/job/" + .jobId),
                                     context: (.name | sub("^(Environment: )?"; "AppVeyor / ")),
                                     state: (.status | sub("queued"; "pending")
diff --git a/.github/workflows/checkdocs.yml b/.github/workflows/checkdocs.yml
index 91ed7452d1..58f5f29f8b 100644
--- a/.github/workflows/checkdocs.yml
+++ b/.github/workflows/checkdocs.yml
@@ -69,7 +69,7 @@ jobs:
   #        run: git ls-files -z '*.md' | xargs -0 -n1 .github/scripts/trimmarkdownheader.pl
   #
   #      - name: 'check prose'
-  #        run: git ls-files -z '*.md' | grep -Evz 'CHECKSRC.md|DISTROS.md|curl_mprintf.md|CURLOPT_INTERFACE.md|interface.md' | xargs -0 proselint README
+  #        run: git ls-files -z '*.md' | grep -Evz 'CHECKSRC\.md|DISTROS\.md|curl_mprintf\.md|CURLOPT_INTERFACE\.md|interface\.md' | xargs -0 proselint -- README
   #
   #      # This is for CHECKSRC and files with aggressive exclamation mark needs
   #      - name: 'create second proselint config'
diff --git a/scripts/cmakelint.sh b/scripts/cmakelint.sh
index 788f087305..9462081f21 100755
--- a/scripts/cmakelint.sh
+++ b/scripts/cmakelint.sh
@@ -77,4 +77,5 @@ cd "$(dirname "$0")"/..
     --max-branches 12 \
     --max-arguments 5 \
     --max-localvars 15 \
-    --max-statements 50
+    --max-statements 50 \
+    --
diff --git a/scripts/firefox-db2pem.sh b/scripts/firefox-db2pem.sh
index 2a4b9ceace..c774ab9107 100755
--- a/scripts/firefox-db2pem.sh
+++ b/scripts/firefox-db2pem.sh
@@ -57,5 +57,5 @@ sed -e 's/ *[CcGTPpu]*,[CcGTPpu]*,[CcGTPpu]* *$//' -e 's/\(.*\)/"\1"/' | \
 sort | \
 while read -r nickname; \
  do echo "$nickname" | sed -e "s/Builtin Object Token://g"; \
- echo "$nickname" | xargs -I{} certutil -d "$db" -L -a -n {} ; \
+ echo "$nickname" | xargs -I{} certutil -d "$db" -L -a -n -- {} ; \
 done >> "$out"
diff --git a/scripts/perlcheck.sh b/scripts/perlcheck.sh
index 7de0f6dbb5..7ec23983d5 100755
--- a/scripts/perlcheck.sh
+++ b/scripts/perlcheck.sh
@@ -48,4 +48,4 @@ echo "parallel: ${procs}"
     # strip off the leading ./ to make the grep regexes work properly
     find . -type f \( -name '*.pl' -o -name '*.pm' \) | sed 's@^\./@@'
   fi
-} | xargs -n 1 -P "${procs}" perl -c -Itests
+} | xargs -n 1 -P "${procs}" perl -c -Itests --
-- 
2.47.3