Skip to content

Commit e7b03f5

Browse files
thomasleplusthomasleplus
committed
ci(gh-actions): bash strict mode
1 parent 1e3793a commit e7b03f5

File tree

10 files changed

+61
-14
lines changed

10 files changed

+61
-14
lines changed

‎.github/workflows/apk-check-versions.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,7 @@ jobs:
1414
steps:
1515
- name: Check the versions
1616
shell: bash
17-
run: docker run --pull always -t --user root --entrypoint /bin/sh "leplusorg/${GITHUB_REPOSITORY#*/docker-}:main" -c 'apk update && apk -u list | tee -a /dev/stderr | grep -q -e . && exit 1'
17+
run: |
18+
set -euo pipefail
19+
IFS=$'\n\t'
20+
docker run --pull always -t --user root --entrypoint /bin/sh "leplusorg/${GITHUB_REPOSITORY#*/docker-}:main" -c 'if apk update && apk -u list | tee -a /dev/stderr | grep -q -e .; then exit 1; fi'

‎.github/workflows/automerge.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ jobs:
1515
- name: Enable auto-merge for Dependabot PRs
1616
shell: bash
1717
run: |
18+
set -euo pipefail
19+
IFS=$'\n\t'
1820
# Checking the PR title is a poor substitute for the actual PR changes
1921
# but as long as this is used only with dependabot PRs,
2022
# it should be safe to assume that the title is not misleading.

‎.github/workflows/check-pr.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ jobs:
1212
- name: Check commits
1313
shell: bash
1414
run: |
15+
set -euo pipefail
16+
IFS=$'\n\t'
1517
# Check the commits
1618
commits_json=$(curl -fsSL -H "Authorization: token ${GITHUB_TOKEN}" "${PR_COMMITS_URL}")
1719
echo -n 'Commits: '
@@ -40,6 +42,8 @@ jobs:
4042
- name: Update PR labels
4143
shell: bash
4244
run: |
45+
set -euo pipefail
46+
IFS=$'\n\t'
4347
# Check PR title is a conventional commit message
4448
regexp='^((build|chore|ci|docs|feat|fix|perf|refactor|style|test)(\([a-zA-Z0-9\-]+\))?)!?: .*$'
4549
if ! [[ "${PR_TITLE}" =~ ${regexp} ]] ; then

‎.github/workflows/docker-build-push.yml‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,16 @@ jobs:
1919
steps:
2020
- name: Set IMAGE
2121
shell: bash
22-
run: echo "IMAGE=${GITHUB_REPOSITORY#*/docker-}" >> "${GITHUB_ENV}"
22+
run: |
23+
set -euo pipefail
24+
IFS=$'\n\t'
25+
echo "IMAGE=${GITHUB_REPOSITORY#*/docker-}" >> "${GITHUB_ENV}"
2326
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2427
- name: Set SOURCE_DATE_EPOCH
25-
run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "${GITHUB_ENV}"
28+
run: |
29+
set -euo pipefail
30+
IFS=$'\n\t'
31+
echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "${GITHUB_ENV}"
2632
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
2733
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
2834
- uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
@@ -37,7 +43,10 @@ jobs:
3743
- name: Test the Docker image
3844
working-directory: ${{ env.IMAGE }}
3945
shell: bash
40-
run: docker compose -f docker-compose.test.yml run sut
46+
run: |
47+
set -euo pipefail
48+
IFS=$'\n\t'
49+
docker compose -f docker-compose.test.yml run sut
4150
- uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
4251
if: github.ref == 'refs/heads/main'
4352
with:
@@ -64,16 +73,19 @@ jobs:
6473
TAGS: ${{ steps.meta.outputs.tags }}
6574
shell: bash
6675
run: |
67-
images=""
76+
set -euo pipefail
77+
IFS=$'\n\t'
78+
images=()
6879
for tag in ${TAGS}; do
69-
images+="${tag}@${DIGEST} "
80+
images+=("${tag}@${DIGEST}")
7081
done
71-
# shellcheck disable=SC2086
72-
cosign sign --recursive --yes ${images}
82+
cosign sign --recursive --yes "${images[@]}"
7383
- name: Set VERSION
7484
if: github.ref == 'refs/heads/main'
7585
shell: bash
7686
run: |
87+
set -euo pipefail
88+
IFS=$'\n\t'
7789
# shellcheck disable=SC2086
7890
VERSION="$(\grep ${IMAGE}/Dockerfile -e '^FROM' | \head -n 1 | \sed -e 's/@.*$//; s/^.*://;')"
7991
if [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] ; then

‎.github/workflows/docker-release.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,16 @@ jobs:
1616
steps:
1717
- name: Set IMAGE
1818
shell: bash
19-
run: echo "IMAGE=${GITHUB_REPOSITORY#*/docker-}" >> "${GITHUB_ENV}"
19+
run: |
20+
set -euo pipefail
21+
IFS=$'\n\t'
22+
echo "IMAGE=${GITHUB_REPOSITORY#*/docker-}" >> "${GITHUB_ENV}"
2023
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2124
- name: Set SOURCE_DATE_EPOCH
22-
run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "${GITHUB_ENV}"
25+
run: |
26+
set -euo pipefail
27+
IFS=$'\n\t'
28+
echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "${GITHUB_ENV}"
2329
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
2430
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
2531
- uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
@@ -57,6 +63,8 @@ jobs:
5763
TAGS: ${{ steps.meta.outputs.tags }}
5864
shell: bash
5965
run: |
66+
set -euo pipefail
67+
IFS=$'\n\t'
6068
images=""
6169
for tag in ${TAGS}; do
6270
images+="${tag}@${DIGEST} "

‎.github/workflows/dockerhub.yml‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,28 @@ jobs:
2020
steps:
2121
- name: Set IMAGE
2222
shell: bash
23-
run: echo "IMAGE=${GITHUB_REPOSITORY#*/docker-}" >> "${GITHUB_ENV}"
23+
run: |
24+
set -euo pipefail
25+
IFS=$'\n\t'
26+
echo "IMAGE=${GITHUB_REPOSITORY#*/docker-}" >> "${GITHUB_ENV}"
2427
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2528
- name: Pull the ${{ matrix.tag }} ${{ matrix.platform }} image
2629
shell: bash
27-
run: docker pull --platform "${{ matrix.platform }}" "${GITHUB_REPOSITORY_OWNER}/${IMAGE}:${{ matrix.tag }}"
30+
run: |
31+
set -euo pipefail
32+
IFS=$'\n\t'
33+
docker pull --platform "${{ matrix.platform }}" "${GITHUB_REPOSITORY_OWNER}/${IMAGE}:${{ matrix.tag }}"
2834
- name: Pull the ${{ matrix.tag }} ${{ matrix.platform }} image SBOM
2935
shell: bash
30-
run: docker buildx imagetools inspect "${GITHUB_REPOSITORY_OWNER}/${IMAGE}:${{ matrix.tag }}" --format "{{ json (index .SBOM \"${{ matrix.platform }}\").SPDX }}"
36+
run: |
37+
set -euo pipefail
38+
IFS=$'\n\t'
39+
docker buildx imagetools inspect "${GITHUB_REPOSITORY_OWNER}/${IMAGE}:${{ matrix.tag }}" --format "{{ json (index .SBOM \"${{ matrix.platform }}\").SPDX }}"
3140
- name: Install cosign
3241
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
3342
- name: Verify the ${{ matrix.tag }} image signature
3443
shell: bash
3544
run: |
45+
set -euo pipefail
46+
IFS=$'\n\t'
3647
cosign verify "${GITHUB_REPOSITORY_OWNER}/${IMAGE}:${{ matrix.tag }}" --certificate-identity-regexp "https://github\.com/${GITHUB_REPOSITORY}/\.github/workflows/.+" --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

‎.github/workflows/npm-check-versions.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,6 @@ jobs:
1515
- name: Check the versions
1616
shell: bash
1717
run: |
18+
set -euo pipefail
19+
IFS=$'\n\t'
1820
docker run --pull always -t --user root "leplusorg/${GITHUB_REPOSITORY#*/docker-}:main" npm outdated --global

‎.github/workflows/pipx-check-versions.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,7 @@ jobs:
1414
steps:
1515
- name: Check the versions
1616
shell: bash
17-
run: docker run --pull always -t --user root --entrypoint /bin/sh "leplusorg/${GITHUB_REPOSITORY#*/docker-}:main" -c 'pipx upgrade-all --global | tee -a /dev/stderr | grep -q -e . && exit 1'
17+
run: |
18+
set -euo pipefail
19+
IFS=$'\n\t'
20+
docker run --pull always -t --user root --entrypoint /bin/sh "leplusorg/${GITHUB_REPOSITORY#*/docker-}:main" -c 'if sudo pipx upgrade-all --global | tee -a /dev/stderr | grep -q -e .; then exit 1; fi'

‎json/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ RUN pipx ensurepath --global \
3333
json2yaml==1.2.0
3434

3535
RUN npm install -g \
36+
[email protected] \
3637
[email protected] \
3738
[email protected] \
3839
[email protected]

‎json/docker-compose.test.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ services:
1616
git --version # git
1717
jq --version # jq
1818
json2yaml --version # json2yaml
19+
jslint --version # jsonlint
1920
jsonlint --help # jsonlint
2021
npm --version # npm
2122
openssl --version # openssl

0 commit comments

Comments
 (0)