From 33cd69e44ed9359c9fbac1195967b94881d406b5 Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Fri, 24 Jul 2026 18:13:08 -0700 Subject: [PATCH] secrets: silence two SC2016s that are the intended behaviour MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit shell-lint failed on two single-quoted strings. Both are deliberate and double-quoting either one would break it silently rather than loudly. In render_centralis_secrets, the verification step runs `bash -c 'set -a; . "$1"'` with the rendered file passed as an argument. The "$1" must be expanded by that inner shell. Double-quoted, it would interpolate the OUTER $1 — the function's own first argument, the repo root — so the check would source the wrong path and still report success. That check exists precisely to catch a bad render, so a false pass there is worse than no check. In verify-centralis-render.sh, the string is executed by the REMOTE shell over ssh. Double-quoted, mktemp would run locally and the script would send the host a path that does not exist there. Suppressed with the reason at each site rather than loosened globally. Claude-Session: https://claude.ai/code/session_0182KTMrsTHJc3TcewCatJFY --- infra/deploy/render-secrets.sh | 5 +++++ infra/deploy/secrets/verify-centralis-render.sh | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/infra/deploy/render-secrets.sh b/infra/deploy/render-secrets.sh index 834fa51..b5de8fc 100755 --- a/infra/deploy/render-secrets.sh +++ b/infra/deploy/render-secrets.sh @@ -330,6 +330,11 @@ EMIT # environment, `set -a`, no inherited variables to mask a dropped key — and # read every value back out. This is the test that the file cannot pass while # carrying the 2026-07-24 bug, and it runs on every render, not once. + # shellcheck disable=SC2016 # single quotes are the point: "$1" must be + # expanded by the inner `bash -c`, against the argument passed after `_`, + # not by this shell. Double-quoting would interpolate the OUTER $1 — the + # function's own first argument, the repo root — and the check would then + # verify the wrong file, or nothing at all, while still reporting success. env -i PATH="$PATH" bash -c \ 'set -a; . "$1"; set +a; exec python3 -c " import json, os, sys diff --git a/infra/deploy/secrets/verify-centralis-render.sh b/infra/deploy/secrets/verify-centralis-render.sh index 5f1d28f..062da77 100755 --- a/infra/deploy/secrets/verify-centralis-render.sh +++ b/infra/deploy/secrets/verify-centralis-render.sh @@ -30,6 +30,10 @@ VAULT="deploy/secrets/centralis.${ENV_NAME}.yaml" SSH=(ssh -i "$SSH_KEY" "$SSH_TARGET") SCP=(scp -q -i "$SSH_KEY") +# shellcheck disable=SC2016 # single quotes are required: this whole string is +# executed by the REMOTE shell, so $d and the command substitution must survive +# the trip intact. Double-quoting would run mktemp locally and then send a path +# that does not exist on the host. scratch="$("${SSH[@]}" 'd=$(mktemp -d) && chmod 700 "$d" && mkdir -p "$d/deploy/secrets" && echo "$d"')" [ -n "$scratch" ] || { echo "!! could not create a scratch dir on the host" >&2; exit 1; } cleanup() { "${SSH[@]}" "rm -rf -- '$scratch'" >/dev/null 2>&1 || true; }