Shellcheck: tools/

tools/check_repositories.sh

@@ -4,7 +4,7 @@ set -eu
 
 # Check whether any git repositories are defined.
 # Git repository definition contains `commit` and `remote` fields.
-if git grep -n "commit =\|remote =" *.bzl; then
+if git grep -n "commit =\|remote =" -- '*.bzl'; then
   echo "Using git repositories is not allowed."
   echo "To ensure that all dependencies can be stored offline in distdir, only HTTP repositories are allowed."
   exit 1
@@ -15,7 +15,7 @@ fi
 urls_count=$(git grep -E "\<url(s)? =" -- '*.bzl' | wc -l)
 sha256sums_count=$(git grep -E "\<sha256 =" -- '*.bzl' | wc -l)
 
-if [[ $urls_count != $sha256sums_count ]]; then
+if [[ $urls_count != "$sha256sums_count" ]]; then
   echo "Found more defined repository URLs than SHA256 sums, which means that there are some repositories without sums."
   echo "Dependencies without SHA256 sums cannot be stored in distdir."
   echo "Please ensure that every repository has a SHA256 sum."

tools/code_format/check_format_test.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
 
-tools=$(dirname $(dirname $(realpath $0)))
-root=$(realpath $tools/..)
-ci=$root/ci
-cd $root
-exec ./ci/run_envoy_docker.sh ./tools/code_format/check_format_test_helper.sh "$@"
+tools="$(dirname "$(dirname "$(realpath "$0")")")"
+root=$(realpath "$tools/..")
+ci="${root}/ci"
+export ci
+cd "$root" || exit 1
+exec ./ci/run_envoy_docker.sh ./tools/code_format/check_format_test_helper.sh "$@"

tools/code_format/check_format_test_helper.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
 
-tools=$(dirname $(dirname $(realpath $0)))
-root=$(realpath $tools/..)
+tools="$(dirname "$(dirname "$(realpath "$0")")")"
+root=$(realpath "$tools/..")
 
-cd $root
+cd "$root" || exit 1
 # to satisfy dependency on run_command
 export PYTHONPATH="$tools"
 ./tools/code_format/check_format_test_helper.py "$@"

tools/code_format/check_shellcheck_format.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-EXCLUDED_SHELLFILES=${EXCLUDED_SHELLFILES:-"^tools|^test|^examples|^ci|^bin|^source|^bazel|^.github"}
+EXCLUDED_SHELLFILES=${EXCLUDED_SHELLFILES:-"^test|^examples|^ci|^bin|^source|^bazel|^.github"}
 
 
 find_shell_files () {

tools/code_format/format_python_tools.sh

@@ -9,7 +9,7 @@
 set -e
 
 echo "Running Python format check..."
-python_venv format_python_tools $1
+python_venv format_python_tools "$1"
 
 echo "Running Python3 flake8 check..."
 python3 -m flake8 --version

tools/docker_wrapper.sh

@@ -14,6 +14,7 @@ if [ "${RUN_REMOTE}" == "yes" ]; then
   echo "Using docker environment from ${DOCKER_ENV}:"
   cat "${DOCKER_ENV}"
 fi
+# shellcheck disable=SC1090
 . "${DOCKER_ENV}"
 
 CONTAINER_NAME="envoy-test-runner"
@@ -27,28 +28,27 @@ function cleanup() {
 
 trap cleanup EXIT
 
-cat > ${ENVFILE} <<EOF
+cat > "${ENVFILE}" <<EOF
 TEST_WORKSPACE=/tmp/workspace
 TEST_SRCDIR=/tmp/src
 ENVOY_IP_TEST_VERSIONS=v4only
 EOF
 
-CMDLINE="set -a && . /env && env && /test $@"
+CMDLINE="set -a && . /env && env && /test $*"
 LIB_PATHS="/lib/x86_64-linux-gnu/ /usr/lib/x86_64-linux-gnu/ /lib64/"
 
 
 if [ "${RUN_REMOTE}" != "yes" ]; then
   # We're running locally. If told to, mount the library directories locally.
-  LIB_MOUNTS=""
+  LIB_MOUNTS=()
   if [ "${LOCAL_MOUNT}" == "yes" ]
   then
     for path in $LIB_PATHS; do
-      LIB_MOUNTS="${LIB_MOUNTS} -v ${path}:${path}:ro"
+      LIB_MOUNTS+=(-v "${path}:${path}:ro")
       done
   fi
 
-  # Note: we don't quote LIB_MOUNTS on purpose; we want it to expand.
-  docker run --rm --privileged  -v "${TEST_PATH}:/test" ${LIB_MOUNTS} -i -v "${ENVFILE}:/env" \
+  docker run --rm --privileged  -v "${TEST_PATH}:/test" "${LIB_MOUNTS[@]}" -i -v "${ENVFILE}:/env" \
     "${IMAGE}" bash -c "${CMDLINE}"
 else
   # In this case, we need to create the container, then make new layers on top of it, since we

tools/git/modified_since_last_github_commit.sh

@@ -1,7 +1,10 @@
 #!/bin/bash
 
-declare -r BASE="$(dirname "$0")"
+BASE="$(dirname "$0")"
+declare -r BASE
 declare -r TARGET_PATH=$1
 declare -r EXTENSION=$2
+export TARGET_PATH
 
-git diff --name-only $("${BASE}"/last_github_commit.sh) | grep "\.${EXTENSION}$"
+
+git diff --name-only "$("${BASE}"/last_github_commit.sh)" | grep "\.${EXTENSION}$"

tools/path_fix.sh

@@ -7,16 +7,15 @@
 #
 # NOTE: This implementation is far from perfect and will need to be refined to cover all cases.
 
-$* 2>&1 |
+"$@" 2>&1 |
   while IFS= read -r LINE
   do
     if [[ "${LINE}" =~ [[:space:]]*([^:[:space:]]+):[[:digit:]]+:[[:digit:]]+: ]]; then
-      REAL_PATH=$(readlink -f "${BASH_REMATCH[1]}")
-      # Bazel now appears to sometimes spit out paths that don't actually exist on disk at all. I
-      # have no idea why this is happening (sigh). This check makes it so that if readlink fails we
-      # don't attempt to fix the path and just print out what we got.
-      if [[ $? == 0 ]]; then
-        LINE=${LINE//${BASH_REMATCH[1]}/${REAL_PATH}}
+      if REAL_PATH=$(readlink -f "${BASH_REMATCH[1]}"); then
+          # Bazel now appears to sometimes spit out paths that don't actually exist on disk at all. I
+          # have no idea why this is happening (sigh). This check makes it so that if readlink fails we
+          # don't attempt to fix the path and just print out what we got.
+          LINE=${LINE//${BASH_REMATCH[1]}/${REAL_PATH}}
       fi
     fi
     echo "${LINE}"

tools/proto_format/proto_format.sh

@@ -5,6 +5,8 @@
 set -e
 set -x
 
+IFS=' ' read -ra BAZEL_BUILD_OPTIONS < <(echo "${BAZEL_BUILD_OPTIONS:-}")
+
 [[ "$1" == "check" || "$1" == "fix" || "$1" == "freeze" ]] || \
   (echo "Usage: $0 <check|fix|freeze>"; exit 1)
 
@@ -18,14 +20,14 @@ if [[ "$2" == "--test" ]]
 then
   echo "protoxform_test..."
   ./tools/protoxform/protoxform_test.sh
-  bazel test ${BAZEL_BUILD_OPTIONS} //tools/protoxform:merge_active_shadow_test
+  bazel test "${BAZEL_BUILD_OPTIONS[@]}" //tools/protoxform:merge_active_shadow_test
 fi
 
 # Generate //versioning:active_protos.
 ./tools/proto_format/active_protos_gen.py ./api > ./api/versioning/BUILD
 
 # This is for local RBE setup, should be no-op for builds without RBE setting in bazelrc files.
-BAZEL_BUILD_OPTIONS+=" --remote_download_outputs=all"
+BAZEL_BUILD_OPTIONS+=("--remote_download_outputs=all")
 
 # If the specified command is 'freeze', we tell protoxform to adjust package version status to
 # reflect a major version freeze and then do a regular 'fix'.
@@ -37,24 +39,26 @@ then
 fi
 
 # Invoke protoxform aspect.
-bazel build ${BAZEL_BUILD_OPTIONS} --//tools/api_proto_plugin:default_type_db_target=@envoy_api_canonical//versioning:active_protos ${FREEZE_ARG} \
+bazel build "${BAZEL_BUILD_OPTIONS[@]}" --//tools/api_proto_plugin:default_type_db_target=@envoy_api_canonical//versioning:active_protos ${FREEZE_ARG} \
   @envoy_api_canonical//versioning:active_protos --aspects //tools/protoxform:protoxform.bzl%protoxform_aspect --output_groups=proto
 
 # Find all source protos.
-declare -r ACTIVE_PROTO_TARGETS=$(bazel query "labels(srcs, labels(deps, @envoy_api_canonical//versioning:active_protos))")
-declare -r FROZEN_PROTO_TARGETS=$(bazel query "labels(srcs, labels(deps, @envoy_api_canonical//versioning:frozen_protos))")
+readarray -t PROTO_TARGETS \
+	  < <(bazel query "labels(srcs, labels(deps, @envoy_api_canonical//versioning:active_protos))")
+readarray -t -O "${#PROTO_TARGETS[@]}" PROTO_TARGETS \
+	  < <(bazel query "labels(srcs, labels(deps, @envoy_api_canonical//versioning:frozen_protos))")
 
 # Setup for proto_sync.py.
-TOOLS=$(dirname $(dirname $(realpath $0)))
+TOOLS="$(dirname "$(dirname "$(realpath "$0")")")"
 # To satisfy dependency on api_proto_plugin.
 export PYTHONPATH="$TOOLS"
 # Build protoprint and merge_active_shadow_tools for use in proto_sync.py.
-bazel build ${BAZEL_BUILD_OPTIONS} //tools/protoxform:protoprint //tools/protoxform:merge_active_shadow
+bazel build "${BAZEL_BUILD_OPTIONS[@]}" //tools/protoxform:protoprint //tools/protoxform:merge_active_shadow
 
 # Copy back the FileDescriptorProtos that protoxform emittted to the source tree. This involves
 # pretty-printing to format with protoprint and potentially merging active/shadow versions of protos
 # with merge_active_shadow.
-./tools/proto_format/proto_sync.py "--mode=${PROTO_SYNC_CMD}" ${ACTIVE_PROTO_TARGETS} ${FROZEN_PROTO_TARGETS}
+./tools/proto_format/proto_sync.py "--mode=${PROTO_SYNC_CMD}" "${PROTO_TARGETS[@]}"
 
 # Need to regenerate //versioning:active_protos before building type DB below if freezing.
 if [[ "$1" == "freeze" ]]
@@ -63,7 +67,7 @@ then
 fi
 
 # Generate api/BUILD file based on updated type database.
-bazel build ${BAZEL_BUILD_OPTIONS} //tools/type_whisperer:api_build_file
+bazel build "${BAZEL_BUILD_OPTIONS[@]}" //tools/type_whisperer:api_build_file
 cp -f bazel-bin/tools/type_whisperer/BUILD.api_build_file api/BUILD
 
 # Misc. manual copies to keep generated_api_shadow/ in sync with api/.

tools/protoxform/protoxform_test.sh

@@ -4,23 +4,25 @@ set -e
 
 rm -rf bazel-bin/tools
 
-BAZEL_BUILD_OPTIONS+=" --remote_download_outputs=all"
+IFS=' ' read -ra BAZEL_BUILD_OPTIONS < <(echo "${BAZEL_BUILD_OPTIONS:-}")
 
-TOOLS=$(dirname $(dirname $(realpath $0)))
+BAZEL_BUILD_OPTIONS+=("--remote_download_outputs=all")
+
+TOOLS="$(dirname "$(dirname "$(realpath "$0")")")"
 # to satisfy dependency on run_command
 export PYTHONPATH="$TOOLS"
 
 # protoxform fix test cases
-PROTO_TARGETS=$(bazel query "labels(srcs, labels(deps, //tools/testdata/protoxform:fix_protos))")
-bazel build ${BAZEL_BUILD_OPTIONS} --//tools/api_proto_plugin:default_type_db_target=//tools/testdata/protoxform:fix_protos \
+read -ra PROTO_TARGETS < <(bazel query "labels(srcs, labels(deps, //tools/testdata/protoxform:fix_protos))")
+bazel build "${BAZEL_BUILD_OPTIONS[@]}" --//tools/api_proto_plugin:default_type_db_target=//tools/testdata/protoxform:fix_protos \
   //tools/testdata/protoxform:fix_protos --aspects //tools/protoxform:protoxform.bzl%protoxform_aspect --output_groups=proto
-bazel build ${BAZEL_BUILD_OPTIONS} //tools/protoxform:protoprint
-./tools/protoxform/protoxform_test_helper.py fix ${PROTO_TARGETS}
+bazel build "${BAZEL_BUILD_OPTIONS[@]}" //tools/protoxform:protoprint
+./tools/protoxform/protoxform_test_helper.py fix "${PROTO_TARGETS[@]}"
 
 # protoxform freeze test cases
-PROTO_TARGETS=$(bazel query "labels(srcs, labels(deps, //tools/testdata/protoxform:freeze_protos))")
-bazel build ${BAZEL_BUILD_OPTIONS} --//tools/api_proto_plugin:default_type_db_target=//tools/testdata/protoxform:freeze_protos \
+read -ra PROTO_TARGETS < <(bazel query "labels(srcs, labels(deps, //tools/testdata/protoxform:freeze_protos))")
+bazel build "${BAZEL_BUILD_OPTIONS[@]}" --//tools/api_proto_plugin:default_type_db_target=//tools/testdata/protoxform:freeze_protos \
   --//tools/api_proto_plugin:extra_args=freeze \
   //tools/testdata/protoxform:freeze_protos --aspects //tools/protoxform:protoxform.bzl%protoxform_aspect --output_groups=proto
-bazel build ${BAZEL_BUILD_OPTIONS} //tools/protoxform:protoprint
-./tools/protoxform/protoxform_test_helper.py freeze ${PROTO_TARGETS}
+bazel build "${BAZEL_BUILD_OPTIONS[@]}" //tools/protoxform:protoprint
+./tools/protoxform/protoxform_test_helper.py freeze "${PROTO_TARGETS[@]}"

tools/shell_utils.sh

@@ -1,10 +1,14 @@
+#!/bin/bash
+
+
 source_venv() {
   VENV_DIR=$1
   if [[ "${VIRTUAL_ENV}" == "" ]]; then
     if [[ ! -d "${VENV_DIR}"/venv ]]; then
       virtualenv "${VENV_DIR}"/venv --python=python3
     fi
-    source "${VENV_DIR}"/venv/bin/activate
+    # shellcheck disable=SC1090
+    source "${VENV_DIR}/venv/bin/activate"
   else
     echo "Found existing virtualenv"
   fi
@@ -21,5 +25,5 @@ python_venv() {
   pip install -r "${SCRIPT_DIR}"/requirements.txt
 
   shift
-  python3 "${SCRIPT_DIR}/${PY_NAME}.py" $*
+  python3 "${SCRIPT_DIR}/${PY_NAME}.py" "$*"
 }

tools/spelling/check_spelling.sh

@@ -19,7 +19,7 @@ MISSPELL_ARGS="-error -o stderr"
 
 if [[ "$#" -lt 1 ]]; then
   echo "Usage: $0 check|fix"
-  exit -1
+  exit 1
 fi
 
 if [[ "$1" == "fix" ]]; then
@@ -39,13 +39,13 @@ SCRIPTPATH=$( cd "$(dirname "$0")" ; pwd -P )
 ROOTDIR="${SCRIPTPATH}/../.."
 cd "$ROOTDIR"
 
-BIN_FILENAME="misspell_"${VERSION}"_"${OS}"_64bit.tar.gz"
+BIN_FILENAME="misspell_${VERSION}_${OS}_64bit.tar.gz"
 # Install tools we need
 if [[ ! -e "${TMP_DIR}/misspell" ]]; then
   if ! wget https://github.com/client9/misspell/releases/download/v"${VERSION}"/"${BIN_FILENAME}" \
   -O "${TMP_DIR}/${BIN_FILENAME}" --no-verbose --tries=3 -o "${TMP_DIR}/wget.log"; then
     cat "${TMP_DIR}/wget.log"
-    exit -1
+    exit 1
   fi
   tar -xvf "${TMP_DIR}/${BIN_FILENAME}" -C "${TMP_DIR}" &> /dev/null
 fi
@@ -61,7 +61,7 @@ else
   EXPECT_SHA="${MAC_MISSPELL_SHA}"
 fi
 
-if [[ ! ${ACTUAL_SHA} == ${EXPECT_SHA} ]]; then
+if [[ ! ${ACTUAL_SHA} == "${EXPECT_SHA}" ]]; then
    echo "Expect shasum is ${ACTUAL_SHA}, but actual is shasum ${EXPECT_SHA}"
    exit 1
 fi
@@ -71,12 +71,12 @@ chmod +x "${TMP_DIR}/misspell"
 # Spell checking
 # All the skipping files are defined in tools/spelling/spelling_skip_files.txt
 SPELLING_SKIP_FILES="${ROOTDIR}/tools/spelling/spelling_skip_files.txt"
+IFS=' ' read -ra SKIP_FILES < "$SPELLING_SKIP_FILES"
+IFS=' ' read -ra SKIP_FILES <<< "${SKIP_FILES[@]/#/-e }"
 
 # All the ignore words are defined in tools/spelling/spelling_allowlist_words.txt
 SPELLING_ALLOWLIST_WORDS_FILE="${ROOTDIR}/tools/spelling/spelling_allowlist_words.txt"
+ALLOWLIST_WORDS=$(grep -vE '^#|^$' "${SPELLING_ALLOWLIST_WORDS_FILE}" | xargs | tr ' ' ',')
 
-ALLOWLIST_WORDS=$(echo -n $(cat "${SPELLING_ALLOWLIST_WORDS_FILE}" | \
-                  grep -v "^#"|grep -v "^$") | tr ' ' ',')
-SKIP_FILES=$(echo $(cat "${SPELLING_SKIP_FILES}") | sed "s| | -e |g")
-git ls-files | grep -v -e ${SKIP_FILES} | xargs "${TMP_DIR}/misspell" -i \
+git ls-files | grep -v "${SKIP_FILES[@]}" | xargs "${TMP_DIR}/misspell" -i \
   "${ALLOWLIST_WORDS}" ${MISSPELL_ARGS}

tools/spelling/check_spelling_pedantic_test.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
 
-tools=$(dirname $(dirname $(realpath $0)))
-root=$(realpath $tools/..)
+tools=$(dirname "$(dirname "$(realpath "$0")")")
+root=$(realpath "$tools/..")
 
-cd $root
+cd "$root" || exit 1
 # to satisfy dependency on run_command
 export PYTHONPATH="$tools"
 ./tools/spelling/check_spelling_pedantic_test.py "$@"