Prevent False Positives in CI

.github/workflows/lint.yml

@@ -14,16 +14,34 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
-      - run: echo "GO_VER=$(cat .tool-versions | grep 'golang ' | cut -d' ' -f2)" >> $GITHUB_ENV
-      - run: echo "NODE_VER=$(cat .tool-versions | grep nodejs | cut -d' ' -f2)" >> $GITHUB_ENV
+      - name: Set Go Version
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "GO_VER=$(cat .tool-versions | grep 'golang ' | cut -d' ' -f2)" >> $GITHUB_ENV
+
+      - name: Set Node Version
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "NODE_VER=$(cat .tool-versions | grep nodejs | cut -d' ' -f2)" >> $GITHUB_ENV
 
       - name: Install asdf & tools
         uses: asdf-vm/actions/install@v3
 
       - name: Add asdf to PATH
-        run: echo "~/.asdf/shims" >> $GITHUB_PATH
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "~/.asdf/shims" >> $GITHUB_PATH
 
-      - run: go mod tidy
+      - name: Go Tidy
+        shell: bash
+        run: |
+          set -euo pipefail
+          go mod tidy
       - name: Run pre-commit
+        shell: bash
         run: |
+          set -euo pipefail
           pre-commit run --show-diff-on-failure --color=always --all-files

.github/workflows/swagger-validation.yml

@@ -20,7 +20,9 @@ jobs:
       # Detect Go version from go.mod
       - name: Detect Go version from go.mod
         id: detect-go-version
+        shell: bash
         run: |
+          set -euo pipefail
           go_version=$(grep '^go ' go.mod | awk '{print $2}')
           echo "Go version detected: $go_version"
           echo "golang-version=$go_version" >> $GITHUB_ENV
@@ -34,22 +36,31 @@ jobs:
 
       # Install swag (Swagger generator)
       - name: Install Swag
+        shell: bash
         run: |
+          set -euo pipefail
           go install github.com/swaggo/swag/cmd/swag@latest
 
       # Verify swag installation
       - name: Verify Swag Installation
+        shell: bash
         run: |
+          set -euo pipefail
           if ! command -v swag &> /dev/null; then
             echo "Swag is not installed. Please ensure Go is properly configured and Swag is installed."
             exit 1
           fi
 
       # Generate the swagger.json
       - name: Generate Swagger file
-        run: make generate-swagger
+        shell: bash
+        run: |
+          set -euo pipefail
+          make generate-swagger
 
       # Compare the newly generated swagger.json with the committed swagger.json
       - name: Check for Swagger differences
+        shell: bash
         run: |
+          set -euo pipefail
           git diff --exit-code pkg/swagger/swagger.json || (echo "Swagger is outdated. Please regenerate it with 'make generate-swagger' and commit the changes." && exit 1)

.github/workflows/testcontainers-integration-tests.yml

@@ -18,7 +18,9 @@ jobs:
       # Detect Go version from test_integration/go.mod
       - name: Detect Go version from test_integration/go.mod
         id: detect-test-go-version
+        shell: bash
         run: |
+          set -euo pipefail
           go_version=$(grep '^go ' test_integration/go.mod | awk '{print $2}')
           echo "Go version detected for integration tests: $go_version"
           echo "GOLANG_TEST_VERSION=$go_version" >> $GITHUB_ENV
@@ -30,7 +32,9 @@ jobs:
           cache: true
 
       - name: Run Go tests in integration test directory
+        shell: bash
         run: |
+          set -euo pipefail
           # TODO: make WebUI happy when compiling
           mkdir -p webui/build
           echo "hello test" > webui/build/index.html

.github/workflows/trigger-development-deployment.yaml

@@ -13,7 +13,9 @@ jobs:
         uses: actions/checkout@v2
 
       - name: Trigger Deployment
+        shell: bash
         run: |
+          set -euo pipefail
           curl -X POST \
           -H "Authorization: token ${{ secrets.BACALHAU_VMI_DEPLOYMENT_SECRET }}" \
           -H "Accept: application/vnd.github+json" \

.github/workflows/trigger-ga-vmi-pipeline-on-release.yml

@@ -15,9 +15,11 @@ jobs:
         uses: actions/checkout@v2
 
       - name: Trigger VMI Build
+        shell: bash
         env:
           REPO: ${{ github.repository }}
         run: |
+          set -euo pipefail
           curl -L -X POST \
           -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
           -H "Accept: application/vnd.github.v3+json" \

.github/workflows/trigger-on-comment.yml

@@ -11,7 +11,9 @@ jobs:
     steps:
       - name: Check if commenter is authorized
         id: check-authorization
+        shell: bash
         run: |
+          set -euo pipefail
           COMMENTER=$(jq --raw-output .comment.user.login "$GITHUB_EVENT_PATH")
           APPROVERS=$(yq e '.approvers[]' OWNERS)
           if echo "$APPROVERS" | grep -Fxq "$COMMENTER"; then

buildkite/scripts/build_python_client.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -euo pipefail
 
 setup_environment_variables() {
   export PYPI_TOKEN=$(buildkite-agent secret get PYPI_TOKEN)

buildkite/scripts/build_python_sdk.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -euo pipefail
 
 setup_environment_variables() {
   export PYPI_TOKEN=$(buildkite-agent secret get PYPI_TOKEN)

buildkite/scripts/build_tarball.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -euo pipefail
+
 export PRIVATE_PEM_B64=$(buildkite-agent secret get PRIVATE_PEM_B64)
 export PUBLIC_PEM_B64=$(buildkite-agent secret get PUBLIC_PEM_B64)
 export PRIVATE_KEY_PASSPHRASE_B64=$(buildkite-agent secret get PRIVATE_KEY_PASSPHRASE_B64)

buildkite/scripts/build_webui.sh

@@ -1,3 +1,5 @@
 #!/bin/bash
 
+set -euo pipefail
+
 make build-webui

buildkite/scripts/lint.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
 set -x
 
 # NB(forrest/udit): this step needs to be done before linting as without it the code doesn't compile since webuid/build DNE.
@@ -11,4 +12,3 @@ make lint
 # TODO(forrest/udit): deprecate pre-commit and replace it with the individual steps required to validate the code.
 # e.g. modtidy check, credentials check, go fmt, test file header validation.
 pre-commit run --show-diff-on-failure --color=always --all-files
-

buildkite/scripts/release_cli.sh

@@ -1,6 +1,6 @@
-
 #!/bin/bash
-set -e
+
+set -euo pipefail
 
 set_environment_variables() {
     export BACALHAU_RELEASE_TOKEN=$(buildkite-agent secret get BACALHAU_RELEASE_TOKEN)

buildkite/scripts/test.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -euo pipefail
+
 # Function to set environment variables
 set_environment_variables() {
     export LOG_LEVEL=DEBUG