Skip to content

Commit b7f9e9a

Browse files
austinvazquezaustinvazquez
authored
ci: add ShellCheck to CI (#458)
Issue #, if available: N/A *Description of changes:* Adds ShellCheck, a bash scripting linter, to CI as a non-critical step and resolves some of the trivial warnings/issues found by the tool. Another round of fixes is needed for some of the non-trivial warnings/issues. *Testing done:* - [x] I've reviewed the guidance in CONTRIBUTING.md #### License Acceptance By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. Signed-off-by: Austin Vazquez <[email protected]>
1 parent 94b7497 commit b7f9e9a

11 files changed

+66
-54
lines changed

‎.github/workflows/ci.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,16 @@ jobs:
6363
# so we will just update it manually whenever it makes sense (e.g., a feature that we want is added).
6464
version: v1.53.3
6565
args: --fix=false --timeout=5m
66+
shellcheck:
67+
name: ShellCheck
68+
runs-on: ubuntu-latest
69+
steps:
70+
- uses: actions/checkout@v3
71+
- name: Run ShellCheck
72+
uses: ludeeus/[email protected]
73+
with:
74+
version: v0.9.0
75+
continue-on-error: true
6676
go-mod-tidy-check:
6777
runs-on: ubuntu-latest
6878
steps:

‎Makefile

+2
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,8 @@ download-licenses:
204204
curl https://raw.githubusercontent.com/golangci/golangci-lint-action/master/LICENSE --output "$(LICENSEDIR)/github.com/golangci/golangci-lint-action/LICENSE"
205205
mkdir -p "$(LICENSEDIR)/github.com/avto-dev/markdown-lint"
206206
curl https://raw.githubusercontent.com/avto-dev/markdown-lint/master/LICENSE --output "$(LICENSEDIR)/github.com/avto-dev/markdown-lint/LICENSE"
207+
mkdir -p "$(LICENSEDIR)"/github.com/ludeeus/action-shellcheck"
208+
curl https://raw.githubusercontent.com/ludeeus/action-shellcheck/blob/2.0.0/LICENSE --output "$(LICENSEDIR)/github.com/ludeeus/action-shellcheck/LICENSE"
207209

208210
### dependencies in ci.yaml - end ###
209211

‎installer-builder/darwin/Resources/uninstall.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ fi
88

99
echo "Finch-__VERSION__ will be REMOVED."
1010
while true; do
11-
read -p "Do you wish to continue [Y/n]?" answer
11+
read -r -p "Do you wish to continue [Y/n]?" answer
1212
[[ $answer == "y" || $answer == "Y" || $answer == "" ]] && break
1313
[[ $answer == "n" || $answer == "N" ]] && exit 0
1414
echo "Please answer with 'y' or 'n'"

‎installer-builder/darwin/scripts/postinstall

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ sudo pkill '^limactl'
88

99
#change permissions in home directory
1010
echo "Change permissions for product home directory."
11-
cd /Applications/Finch
11+
cd /Applications/Finch || exit
1212
chmod -R 777 .
1313
chmod -R 755 /Applications/Finch/dependencies/lima-socket_vmnet/opt/finch
1414
[ -d /usr/local/bin ] || mkdir /usr/local/bin

‎installer-builder/tools/artifact-helper.sh

+19-19
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,16 @@ DELAY=60
88
#$2: executable bucket
99
#$3: pkg bucket
1010
cleanUpSigningArtifactInS3Buckets() {
11-
aws s3 rm s3://${2}-${1//_/-}/pre-signed/package.tar.gz
12-
aws s3 rm s3://${2}-${1//_/-}/signed/finch-executables-${1//_/-}.zip
13-
aws s3 rm s3://${3}-${1//_/-}/pre-signed/package.tar.gz
14-
aws s3 rm s3://${3}-${1//_/-}/signed/finch-pkg-${1//_/-}.zip
11+
aws s3 rm "s3://${2}-${1//_/-}/pre-signed/package.tar.gz"
12+
aws s3 rm "s3://${2}-${1//_/-}/signed/finch-executables-${1//_/-}.zip"
13+
aws s3 rm "s3://${3}-${1//_/-}/pre-signed/package.tar.gz"
14+
aws s3 rm "s3://${3}-${1//_/-}/signed/finch-pkg-${1//_/-}.zip"
1515
}
1616

1717
#$1: arch: {x86_64, aarch64}
1818
#$2: executable bucket
1919
uploadUnsignedExecutables() {
20-
aws s3 cp ./installer-builder/output/executables/unsigned/package.tar.gz s3://${2}-${1//_/-}/pre-signed/package.tar.gz --no-progress
20+
aws s3 cp ./installer-builder/output/executables/unsigned/package.tar.gz "s3://${2}-${1//_/-}/pre-signed/package.tar.gz" --no-progress
2121
}
2222

2323
#$1: arch: {x86_64, aarch64}
@@ -26,25 +26,25 @@ downloadSignedExecutables() {
2626
attempts=0
2727
while [ $attempts -lt $MAX_RETRY ]
2828
do
29-
aws s3 cp s3://${2}-${1//_/-}/signed/finch-executables-${1//_/-}.zip ./installer-builder/output/executables/signed --no-progress && break
30-
attempts=$(($attempts+1))
29+
aws s3 cp "s3://${2}-${1//_/-}/signed/finch-executables-${1//_/-}.zip" ./installer-builder/output/executables/signed --no-progress && break
30+
attempts=$((attempts+1))
3131
echo "Wait $DELAY seconds and retry..."
3232
sleep $DELAY
3333
done
3434

3535
if [ $attempts -eq $MAX_RETRY ]
3636
then
37-
echo "Download failed after $MAT_RETRY attempts."
37+
echo "Download failed after $MAX_RETRY attempts."
3838
fi
3939

40-
tar xzvf ./installer-builder/output/executables/signed/finch-executables-${1//_/-}.zip -C ./installer-builder/output/executables/signed
41-
aws s3 rm s3://${2}-${1//_/-}/pre-signed/package.tar.gz
40+
tar xzvf "./installer-builder/output/executables/signed/finch-executables-${1//_/-}.zip" -C ./installer-builder/output/executables/signed
41+
aws s3 "rm s3://${2}-${1//_/-}/pre-signed/package.tar.gz"
4242
}
4343

4444
#$1: arch: {x86_64, aarch64}
4545
#$2: pkg bucket
4646
uploadUnsignedPkg() {
47-
aws s3 cp ./installer-builder/output/installer/unsigned/package.tar.gz s3://${2}-${1//_/-}/pre-signed/package.tar.gz --no-progress
47+
aws s3 cp ./installer-builder/output/installer/unsigned/package.tar.gz "s3://${2}-${1//_/-}/pre-signed/package.tar.gz" --no-progress
4848
}
4949

5050
#$1: arch: {x86_64, aarch64}
@@ -53,27 +53,27 @@ downloadSignedPkg() {
5353
attempts=0
5454
while [ $attempts -lt $MAX_RETRY ]
5555
do
56-
aws s3 cp s3://${2}-${1//_/-}/signed/finch-pkg-${1//_/-}.zip ./installer-builder/output/installer/signed --no-progress && break
57-
attempts=$(($attempts+1))
56+
aws s3 cp "s3://${2}-${1//_/-}/signed/finch-pkg-${1//_/-}.zip" ./installer-builder/output/installer/signed --no-progress && break
57+
attempts=$((attempts+1))
5858
echo "Wait $DELAY seconds and retry..."
5959
sleep $DELAY
6060
done
6161

6262
if [ $attempts -eq $MAX_RETRY ]
6363
then
64-
echo "Download failed after $MAT_RETRY attempts."
64+
echo "Download failed after $MAX_RETRY attempts."
6565
fi
6666

67-
tar xzvf ./installer-builder/output/installer/signed/finch-pkg-${1//_/-}.zip -C ./installer-builder/output/installer/signed
68-
aws s3 rm s3://${2}-${1//_/-}/pre-signed/package.tar.gz
67+
tar xzvf "./installer-builder/output/installer/signed/finch-pkg-${1//_/-}.zip" -C ./installer-builder/output/installer/signed
68+
aws s3 rm "s3://${2}-${1//_/-}/pre-signed/package.tar.gz"
6969
}
7070

7171
#$1: arch: {x86_64, aarch64}
7272
#$2: version
7373
#$3: private pkg bucket
7474
uploadNotarizedPkg() {
7575
#rename and upload the final installer
76-
mv ./installer-builder/output/installer/signed/Payload/Finch.pkg ./installer-builder/output/installer/signed/Payload/Finch-${2}-${1}.pkg
77-
aws s3 rm s3://${3}/Finch-${2}-${1}.pkg
78-
aws s3 cp ./installer-builder/output/installer/signed/Payload/Finch-${2}-${1}.pkg s3://${3}/Finch-${2}-${1}.pkg --no-progress
76+
mv ./installer-builder/output/installer/signed/Payload/Finch.pkg "./installer-builder/output/installer/signed/Payload/Finch-${2}-${1}.pkg"
77+
aws s3 rm "s3://${3}/Finch-${2}-${1}.pkg"
78+
aws s3 cp "./installer-builder/output/installer/signed/Payload/Finch-${2}-${1}.pkg" "s3://${3}/Finch-${2}-${1}.pkg" --no-progress
7979
}

‎installer-builder/tools/build-macos-pkg.sh

+7-7
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,18 @@ buildPkgInstaller() {
1010

1111
#copy pkg resources and replace version placeholder
1212
cp -r ./installer-builder/darwin $INSTALLER_FULL_PATH/
13-
sed -i '' -e 's/__VERSION__/'${VERSION}'/g' $INSTALLER_FULL_PATH/darwin/scripts/postinstall
14-
sed -i '' -e 's/__VERSION__/'${VERSION}'/g' $INSTALLER_FULL_PATH/darwin/distribution.xml
13+
sed -i '' -e 's/__VERSION__/'"${VERSION}"'/g' $INSTALLER_FULL_PATH/darwin/scripts/postinstall
14+
sed -i '' -e 's/__VERSION__/'"${VERSION}"'/g' $INSTALLER_FULL_PATH/darwin/distribution.xml
1515

1616
#distribution file requires different value for aarch64
17-
if [ $ARCH == "x86_64" ]
17+
if [ "$ARCH" == "x86_64" ]
1818
then
1919
supportedArch="x86_64"
2020
else
2121
supportedArch="arm64"
2222
fi
2323
sed -i '' -e 's/__ARCH__/'${supportedArch}'/g' $INSTALLER_FULL_PATH/darwin/distribution.xml
24-
sed -i '' -e 's/__VERSION__/'${VERSION}'/g' $INSTALLER_FULL_PATH/darwin/Resources/*.html
24+
sed -i '' -e 's/__VERSION__/'"${VERSION}"'/g' $INSTALLER_FULL_PATH/darwin/Resources/*.html
2525

2626
#copy signed finch build to pkg resource
2727
mkdir -p $INSTALLER_FULL_PATH/darwinpkg
@@ -36,16 +36,16 @@ buildPkgInstaller() {
3636

3737
#copy uninstall script and replace version placeholder
3838
cp ./installer-builder/darwin/Resources/uninstall.sh $INSTALLER_FULL_PATH/darwinpkg/Applications/Finch
39-
sed -i '' -e 's/__VERSION__/'${VERSION}'/g' $INSTALLER_FULL_PATH/darwinpkg/Applications/Finch/uninstall.sh
39+
sed -i '' -e 's/__VERSION__/'"${VERSION}"'/g' $INSTALLER_FULL_PATH/darwinpkg/Applications/Finch/uninstall.sh
4040

4141
#construct pkg directory
4242
mkdir -p $INSTALLER_FULL_PATH/package
4343
mkdir -p $INSTALLER_FULL_PATH/signed
4444
mkdir -p $INSTALLER_FULL_PATH/unsigned/package/artifact
4545

4646
#build pkg
47-
pkgbuild --identifier org.Finch.${VERSION} \
48-
--version $VERSION \
47+
pkgbuild --identifier org.Finch."${VERSION}" \
48+
--version "$VERSION" \
4949
--scripts $INSTALLER_FULL_PATH/darwin/scripts \
5050
--root $INSTALLER_FULL_PATH/darwinpkg \
5151
$INSTALLER_FULL_PATH/package/Finch.pkg > /dev/null 2>&1

‎installer-builder/tools/extract-executables.sh

+10-10
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ packageUnsignedExecutables() {
1515
extractExecutables ./installer-builder/output/origin/_output
1616

1717
#prepare unsigned executable into .tar
18-
cd ./installer-builder/output/executables/unsigned/package
18+
cd ./installer-builder/output/executables/unsigned/package || exit
1919
tar -cvzf artifact.gz -C artifact .
2020
tar -cvzf ../package.tar.gz manifest.yaml artifact.gz
2121
}
@@ -36,15 +36,15 @@ updateQEMUEntitlement() {
3636

3737
#$1: the file object
3838
extractExecutables() {
39-
for file in `ls -a $1`
39+
for file in $(ls -a "$1")
4040
do
41-
if [ -d $1/$file ];
41+
if [ -d "$1/$file" ];
4242
then
4343
if [[ $file != '.' && $file != '..' ]];
4444
then
45-
extractExecutables $1/$file
45+
extractExecutables "$1/$file"
4646
fi
47-
elif [[ -x $1/$file || ($file == *.dylib && !(-L $1/$file)) ]];
47+
elif [[ -x $1/$file || ($file == *.dylib && ! (-L $1/$file)) ]];
4848
then
4949
#extract executables from all file directory to one folder
5050
#to have the ability to merge back, rename the executables with the file path
@@ -53,20 +53,20 @@ extractExecutables() {
5353
#1) ./a will be removed
5454
#2) '/' will be replaced by '__'
5555
#3) final executable name is 'b__c'
56-
relativepath=$(echo $1/$file | sed 's|./installer-builder/output/origin/_output/||')
56+
relativepath=$(echo "$1/$file" | sed 's|./installer-builder/output/origin/_output/||')
5757
newname=${relativepath//\//__}
5858

5959
#copy executable to destination folder
60-
cp -a $1/$file ./installer-builder/output/executables/unsigned/package/artifact/EXECUTABLES_TO_SIGN/$newname
61-
codesign --remove-signature ./installer-builder/output/executables/unsigned/package/artifact/EXECUTABLES_TO_SIGN/$newname
60+
cp -a "$1/$file" ./installer-builder/output/executables/unsigned/package/artifact/EXECUTABLES_TO_SIGN/"$newname"
61+
codesign --remove-signature ./installer-builder/output/executables/unsigned/package/artifact/EXECUTABLES_TO_SIGN/"$newname"
6262

6363
#qemu needs specific entitlement, handle it separately
6464
if [[ $file == "qemu-system-x86_64" || $file == "qemu-system-aarch64" ]];
6565
then
66-
updateQEMUEntitlement $newname
66+
updateQEMUEntitlement "$newname"
6767
elif [[ $file != "qemu-img" ]];
6868
then
69-
updateEntitlement $newname
69+
updateEntitlement "$newname"
7070
fi
7171
fi
7272
done

‎installer-builder/tools/merge-back-signed-executables.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/bin/bash
22

33
mergeBackSignedExecutables() {
4-
for file in `ls -a ./installer-builder/output/executables/signed/Payload/EXECUTABLES_TO_SIGN`
4+
for file in $(ls -a ./installer-builder/output/executables/signed/Payload/EXECUTABLES_TO_SIGN)
55
do
66
if [[ $file != '.' && $file != '..' ]]
77
then
@@ -13,7 +13,7 @@ mergeBackSignedExecutables() {
1313
#3) final executable path is './a/b/c'
1414
originalPath=${file//__/\/}
1515
fullPath=./installer-builder/output/origin/_output/$originalPath
16-
cp -f ./installer-builder/output/executables/signed/Payload/EXECUTABLES_TO_SIGN/$file $fullPath
16+
cp -f ./installer-builder/output/executables/signed/Payload/EXECUTABLES_TO_SIGN/"$file" "$fullPath"
1717
fi
1818
done
1919
}

‎installer-builder/tools/notarize.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22

33
#$1: the account name
44
#$2: the credential
5-
cd ./installer-builder/output/installer/signed/Payload
5+
cd ./installer-builder/output/installer/signed/Payload || exit
66
ditto -c -k --sequesterRsrc --keepParent Finch.pkg Finch.zip
7-
xcrun notarytool submit Finch.zip --apple-id ${1} --password ${2} --team-id 94KV3E626L --wait
7+
xcrun notarytool submit Finch.zip --apple-id "${1}" --password "${2}" --team-id 94KV3E626L --wait

‎installer-builder/tools/pack-unsigned-pkg.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
createUnsignedPkgTarball() {
44
#prepare unsigned .pkg into .tar
55
cp -a ./installer-builder/templates/manifest_pkg.yaml ./installer-builder/output/installer/unsigned/package/manifest.yaml
6-
cd ./installer-builder/output/installer/unsigned/package
6+
cd ./installer-builder/output/installer/unsigned/package || exit
77
tar -cvzf artifact.gz -C artifact .
88
tar -cvzf ../package.tar.gz manifest.yaml artifact.gz
99
}

‎installer-builder/tools/release-installer.sh

+11-11
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ NOTARIZATION_CREDENTIAL=${7}
1313
releaseInstaller() {
1414
echo "Finch-$FINCH_VERSION-$ARCH.pkg Installer Generation Started..."
1515
echo "[1/12] Clean Old Signing Artifact in S3 Buckets"
16-
cleanUpSigningArtifactInS3Buckets $ARCH $EXECUTABLE_BUCKET $PKG_BUCKET
16+
cleanUpSigningArtifactInS3Buckets "$ARCH" "$EXECUTABLE_BUCKET" "$PKG_BUCKET"
1717
rm -rf "./installer-builder/output"
1818
mkdir -pv "./installer-builder/output"
1919

@@ -22,34 +22,34 @@ releaseInstaller() {
2222
cp -RP ./_output "./installer-builder/output/origin"
2323

2424
echo "[3/12] Extract Executables from Finch Build"
25-
bash ./installer-builder/tools/extract-executables.sh $ARCH
25+
bash ./installer-builder/tools/extract-executables.sh "$ARCH"
2626

2727
echo "[4/12] Upload Unsigned Executables to S3 Buckets"
28-
uploadUnsignedExecutables $ARCH $EXECUTABLE_BUCKET
28+
uploadUnsignedExecutables "$ARCH" "$EXECUTABLE_BUCKET"
2929

3030
echo "[5/12] Download Signed Executables from S3 Buckets"
31-
downloadSignedExecutables $ARCH $EXECUTABLE_BUCKET
31+
downloadSignedExecutables "$ARCH" "$EXECUTABLE_BUCKET"
3232

3333
echo "[6/12] Merge Back Signed Executables to Finch Build"
34-
bash ./installer-builder/tools/merge-back-signed-executables.sh $ARCH
34+
bash ./installer-builder/tools/merge-back-signed-executables.sh "$ARCH"
3535

3636
echo "[7/12] Build .pkg"
37-
bash ./installer-builder/tools/build-macos-pkg.sh $ARCH $FINCH_VERSION
37+
bash ./installer-builder/tools/build-macos-pkg.sh "$ARCH" "$FINCH_VERSION"
3838

3939
echo "[8/12] Pack Unsigned .pkg"
40-
bash ./installer-builder/tools/pack-unsigned-pkg.sh $ARCH
40+
bash ./installer-builder/tools/pack-unsigned-pkg.sh "$ARCH"
4141

4242
echo "[9/12] Upload Unsigned .pkg to S3 Buckets"
43-
uploadUnsignedPkg $ARCH $PKG_BUCKET
43+
uploadUnsignedPkg "$ARCH" "$PKG_BUCKET"
4444

4545
echo "[10/12] Download Signed .pkg from S3 Buckets"
46-
downloadSignedPkg $ARCH $PKG_BUCKET
46+
downloadSignedPkg "$ARCH" "$PKG_BUCKET"
4747

4848
echo "[11/12] App Store Notarization"
49-
bash ./installer-builder/tools/notarize.sh $NOTARIZATION_ACCOUNT $NOTARIZATION_CREDENTIAL
49+
bash ./installer-builder/tools/notarize.sh "$NOTARIZATION_ACCOUNT" "$NOTARIZATION_CREDENTIAL"
5050

5151
echo "[12/12] Upload installer to S3 buckets"
52-
uploadNotarizedPkg $ARCH $FINCH_VERSION $INSTALLER_PRIVATE_BUCKET_NAME
52+
uploadNotarizedPkg "$ARCH" "$FINCH_VERSION" "$INSTALLER_PRIVATE_BUCKET_NAME"
5353

5454
echo "Finch-$FINCH_VERSION-$ARCH.pkg Installer Generation Completed!"
5555
}

0 commit comments

Comments
 (0)