aws · guessi · Dec 13, 2025
@@ -8,7 +8,7 @@ MAKE_FILE_PATH="${REPO_ROOT_PATH}/Makefile"
 BIN_DIR="${SCRIPTPATH}/../build/bin"
 mkdir -p "${BIN_DIR}"
 
-VERSION=$(make -s -f ${MAKE_FILE_PATH} version)
+VERSION=$(make -s -f "${MAKE_FILE_PATH}" version)
 PLATFORMS=("linux/amd64")
 
 USAGE=$(cat << 'EOM'
@@ -23,7 +23,7 @@ EOM
 )
 
 # Process our input arguments
-while getopts "dp:v:" opt; do
+while getopts "p:v:" opt; do
   case ${opt} in
     p ) # Platform Pairs
         IFS=',' read -ra PLATFORMS <<< "$OPTARG"
@@ -39,19 +39,19 @@ while getopts "dp:v:" opt; do
 done
 
 for os_arch in "${PLATFORMS[@]}"; do
-    os=$(echo $os_arch | cut -d'/' -f1)
-    arch=$(echo $os_arch | cut -d'/' -f2)
+    os=$(echo "$os_arch" | cut -d'/' -f1)
+    arch=$(echo "$os_arch" | cut -d'/' -f2)
     container_name="extract-aeis-$os-$arch"
     repo_name="aeis-bin"
     base_bin_name="ec2-instance-selector"
     bin_name="${base_bin_name}-${os}-${arch}"
 
-    docker container rm $container_name || :
-    $SCRIPTPATH/build-docker-images -p $os_arch -v $VERSION -r $repo_name
-    docker container create --rm --name $container_name "$repo_name:$VERSION-$os-$arch"
-    docker container cp $container_name:/ec2-instance-selector $BIN_DIR/$bin_name
+    docker container rm "$container_name" || :
+    "$SCRIPTPATH/build-docker-images" -p "$os_arch" -v "$VERSION" -r "$repo_name"
+    docker container create --rm --name "$container_name" "$repo_name:$VERSION-$os-$arch"
+    docker container cp "$container_name":/ec2-instance-selector "$BIN_DIR/$bin_name"
 
-    cp ${BIN_DIR}/${bin_name} ${BIN_DIR}/${base_bin_name}
-    tar -zcvf ${BIN_DIR}/${bin_name}.tar.gz -C ${BIN_DIR} ${base_bin_name}
-    rm -f ${BIN_DIR}/${base_bin_name}
+    cp "${BIN_DIR}/${bin_name}" "${BIN_DIR}/${base_bin_name}"
+    tar -zcvf "${BIN_DIR}/${bin_name}.tar.gz" -C "${BIN_DIR}" "${base_bin_name}"
+    rm -f "${BIN_DIR}/${base_bin_name}"
 done
@@ -6,7 +6,7 @@ SCRIPTPATH="$( cd "$(dirname "$0")" ; pwd -P )"
 REPO_ROOT_PATH=$SCRIPTPATH/../
 MAKE_FILE_PATH=$REPO_ROOT_PATH/Makefile
 
-VERSION=$(make -s -f $MAKE_FILE_PATH version)
+VERSION=$(make -s -f "$MAKE_FILE_PATH" version)
 PLATFORMS=("linux/amd64")
 GOPROXY="direct|https://proxy.golang.org"
 
@@ -24,7 +24,7 @@ EOM
 )
 
 # Process our input arguments
-while getopts "dp:r:v:" opt; do
+while getopts "p:r:v:" opt; do
   case ${opt} in
     p ) # Platform Pairs
         IFS=',' read -ra PLATFORMS <<< "$OPTARG"
@@ -43,15 +43,15 @@ while getopts "dp:r:v:" opt; do
 done
 
 for os_arch in "${PLATFORMS[@]}"; do
-    os=$(echo $os_arch | cut -d'/' -f1)
-    arch=$(echo $os_arch | cut -d'/' -f2)
+    os=$(echo "$os_arch" | cut -d'/' -f1)
+    arch=$(echo "$os_arch" | cut -d'/' -f2)
 
     img_tag="$IMAGE_REPO:$VERSION-$os-$arch"
 
     docker build \
-        --build-arg GOOS=${os} \
-        --build-arg GOARCH=${arch} \
-        --build-arg GOPROXY=${GOPROXY} \
-        -t ${img_tag} \
-        ${REPO_ROOT_PATH}
+        --build-arg GOOS="${os}" \
+        --build-arg GOARCH="${arch}" \
+        --build-arg GOPROXY="${GOPROXY}" \
+        -t "${img_tag}" \
+        "${REPO_ROOT_PATH}"
 done
@@ -107,13 +107,13 @@ sync_local_tags_from_remote() {
 }
 
 create_tag() {
-    git tag $NEW_TAG
+    git tag "$NEW_TAG"
     echo -e "\n✅ Created new tag $NEW_TAG (Current latest release tag in remote: v$CURR_REMOTE_RELEASE_TAG)\n"
     exit 0
 }
 
 get_latest_tag() {
-    make -s -f $MAKEFILE_PATH latest-release-tag | cut -b 2-
+    make -s -f "$MAKEFILE_PATH" latest-release-tag | cut -b 2-
 }
 
 main() {
@@ -129,19 +129,19 @@ main() {
 
     # increment version
     if $MAJOR_INC || $MINOR_INC || $PATCH_INC; then
-        curr_major_v=$(echo $CURR_REMOTE_RELEASE_TAG | tr '.' '\n' | head -1)
-        curr_minor_v=$(echo $CURR_REMOTE_RELEASE_TAG | tr '.' '\n' | head -2 | tail -1)
-        curr_patch_v=$(echo $CURR_REMOTE_RELEASE_TAG | tr '.' '\n' | tail -1)
+        curr_major_v=$(echo "$CURR_REMOTE_RELEASE_TAG" | tr '.' '\n' | head -1)
+        curr_minor_v=$(echo "$CURR_REMOTE_RELEASE_TAG" | tr '.' '\n' | head -2 | tail -1)
+        curr_patch_v=$(echo "$CURR_REMOTE_RELEASE_TAG" | tr '.' '\n' | tail -1)
 
         if [[ $MAJOR_INC == true ]]; then
-            new_major_v=$(echo $(($curr_major_v + 1)))
-            NEW_TAG=$(echo v$new_major_v.0.0)
+            new_major_v=$((curr_major_v + 1))
+            NEW_TAG="v$new_major_v.0.0"
         elif [[ $MINOR_INC == true ]]; then
-            new_minor_v=$(echo $(($curr_minor_v + 1)))
-            NEW_TAG=$(echo v$curr_major_v.$new_minor_v.0)
+            new_minor_v=$((curr_minor_v + 1))
+            NEW_TAG="v$curr_major_v.$new_minor_v.0"
         elif [[ $PATCH_INC == true ]]; then
-            new_patch_v=$(echo $(($curr_patch_v + 1)))
-            NEW_TAG=$(echo v$curr_major_v.$curr_minor_v.$new_patch_v)
+            new_patch_v=$((curr_patch_v + 1))
+            NEW_TAG="v$curr_major_v.$curr_minor_v.$new_patch_v"
         fi
         create_tag
     fi

@@ -10,8 +10,8 @@ set -euo pipefail
 
 REPO_ROOT_PATH="$( cd "$(dirname "$0")"; cd ../; pwd -P )"
 MAKEFILE_PATH=$REPO_ROOT_PATH/Makefile
-LATEST_VERSION=$(make -s -f $MAKEFILE_PATH latest-release-tag | cut -b 2- )
-PREVIOUS_VERSION=$(make -s -f $MAKEFILE_PATH previous-release-tag | cut -b 2- )
+LATEST_VERSION=$(make -s -f "$MAKEFILE_PATH" latest-release-tag | cut -b 2- )
+PREVIOUS_VERSION=$(make -s -f "$MAKEFILE_PATH" previous-release-tag | cut -b 2- )
 
 # files with versions, to update
 REPO_README=$REPO_ROOT_PATH/README.md
@@ -24,7 +24,7 @@ NEW_BRANCH="pr/$LATEST_TAG-release"
 COMMIT_MESSAGE="🥑🤖 $LATEST_TAG release prep 🤖🥑"
 
 # PR details
-DEFAULT_REPO_FULL_NAME=$(make -s -f $MAKEFILE_PATH repo-full-name)
+DEFAULT_REPO_FULL_NAME=$(make -s -f "$MAKEFILE_PATH" repo-full-name)
 PR_BASE=main  # target
 PR_TITLE="🥑🤖 $LATEST_TAG release prep"
 PR_BODY="🥑🤖 Auto-generated PR for $LATEST_TAG release. Updating release versions in repo."
@@ -76,7 +76,7 @@ process_args() {
     done
 
     # set repo full name to the default value if unset
-    if [ -z $REPO_FULL_NAME ]; then
+    if [ -z "$REPO_FULL_NAME" ]; then
         REPO_FULL_NAME=$DEFAULT_REPO_FULL_NAME
     fi
 }
@@ -100,7 +100,7 @@ verify_origin_tracking() {
 }
 
 create_release_branch() {
-    exists=$(git checkout -b $NEW_BRANCH 2>&1) || true
+    exists=$(git checkout -b "$NEW_BRANCH" 2>&1) || true
 
     if [[ $exists == "fatal: A branch named '$NEW_BRANCH' already exists." ]]; then
         echo -e "❌ ${RED}$exists${RESET_FMT}"
@@ -115,9 +115,13 @@ update_versions() {
     echo -e "🥑 Attempting to update instance-selector release version in preparation for a new release."
 
     for f in "${FILES[@]}"; do
-        has_incorrect_version=$(cat $f | grep $PREVIOUS_VERSION)
+        has_incorrect_version=$(cat "$f" | grep "$PREVIOUS_VERSION")
         if [[ ! -z  $has_incorrect_version ]]; then
-            sed -i '' "s/$PREVIOUS_VERSION/$LATEST_VERSION/g" $f
+            if [[ "$OSTYPE" == "darwin"* ]]; then
+                sed -i '' "s/$PREVIOUS_VERSION/$LATEST_VERSION/g" "$f"
+            else
+                sed -i "s/$PREVIOUS_VERSION/$LATEST_VERSION/g" "$f"
+            fi
             FILES_CHANGED+=("$f")
         fi
     done
@@ -139,7 +143,7 @@ commit_changes() {
 }
 
 confirm_with_user_and_create_pr(){
-    git checkout $NEW_BRANCH # checkout new branch before printing git diff
+    git checkout "$NEW_BRANCH" # checkout new branch before printing git diff
 
     echo -e "\n🥑${BOLD}The following PR will be created:\n"
     cat << EOM
@@ -155,7 +159,7 @@ confirm_with_user_and_create_pr(){
 EOM
     while true; do
         echo -e "🥑${BOLD}Do you wish to create the release prep PR? Enter y/n"
-        read -p "" yn
+        read -r -p "" yn
         case $yn in
             [Yy]* ) create_pr; break;;
             [Nn]* ) rollback; exit;;
@@ -166,27 +170,28 @@ EOM
 }
 
 create_pr() {
-    git push -u origin $NEW_BRANCH # sets source branch for PR to NEW_BRANCH on the fork or origin
-    git checkout $NEW_BRANCH # checkout new branch before creating a pr
+    git push -u origin "$NEW_BRANCH" # sets source branch for PR to NEW_BRANCH on the fork or origin
+    git checkout "$NEW_BRANCH" # checkout new branch before creating a pr
 
+    local pr_result=0
     if [[ $DRAFT == true ]]; then
         gh pr create \
             --repo "$REPO_FULL_NAME" \
             --base "$PR_BASE" \
             --title "$PR_TITLE" \
             --body "$PR_BODY" \
             --label "$PR_LABEL_1" --label "$PR_LABEL_2" \
-            --draft
+            --draft || pr_result=$?
     else
         gh pr create \
             --repo "$REPO_FULL_NAME" \
             --base "$PR_BASE" \
             --title "$PR_TITLE" \
             --body "$PR_BODY" \
-            --label "$PR_LABEL_1" --label "$PR_LABEL_2"
+            --label "$PR_LABEL_1" --label "$PR_LABEL_2" || pr_result=$?
     fi
 
-    if [[ $? == 0 ]]; then
+    if [[ $pr_result == 0 ]]; then
         echo -e "✅✅✅✅ ${BOLD}Created $LATEST_TAG release prep PR\n${RESET_FMT}"
     else
         echo -e "❌ ${RED}PR creation failed.${RESET_FMT}❌"
@@ -203,21 +208,21 @@ rollback() {
         git checkout main
 
         # delete local and remote release branch only if current execution of the script created them
-        git branch -D $NEW_BRANCH
-        git push origin --delete $NEW_BRANCH
+        git branch -D "$NEW_BRANCH"
+        git push origin --delete "$NEW_BRANCH"
     fi
     echo "${RESET_FMT}"
 }
 
 handle_errors() {
     # error handling
-    if [ $1 != "0" ]; then
+    if [ "$1" != "0" ]; then
         FAILED_COMMAND=${*:2}
         echo -e "\n❌ ${RED}Error occurred while running command '$FAILED_COMMAND'.${RESET_FMT}❌"
         rollback
         exit 1
     fi
-    exit $1
+    exit "$1"
 }
 
 main() {

@@ -6,7 +6,7 @@ SCRIPTPATH="$( cd "$(dirname "$0")" ; pwd -P )"
 REPO_ROOT_PATH=$SCRIPTPATH/../
 MAKE_FILE_PATH=$REPO_ROOT_PATH/Makefile
 
-VERSION=$(make -s -f $MAKE_FILE_PATH version)
+VERSION=$(make -s -f "$MAKE_FILE_PATH" version)
 PLATFORMS=("linux/amd64")
 MANIFEST_IMAGES=""
 MANIFEST=""
@@ -54,39 +54,41 @@ if [[ ${#PLATFORMS[@]} -gt 1 && $MANIFEST != "true" ]]; then
 fi
 
 for os_arch in "${PLATFORMS[@]}"; do
-    os=$(echo $os_arch | cut -d'/' -f1)
-    arch=$(echo $os_arch | cut -d'/' -f2)
+    os=$(echo "$os_arch" | cut -d'/' -f1)
+    arch=$(echo "$os_arch" | cut -d'/' -f2)
 
     img_tag_w_platform="$IMAGE_REPO:$VERSION-$os-$arch"
 
     if [[ $MANIFEST == "true" ]]; then
         img_tag=$img_tag_w_platform
     else 
         img_tag="$IMAGE_REPO:$VERSION"
-        docker tag $img_tag_w_platform $img_tag
+        docker tag "$img_tag_w_platform" "$img_tag"
     fi
 
-    docker push $img_tag
+    docker push "$img_tag"
     MANIFEST_IMAGES="$MANIFEST_IMAGES $img_tag"
 done
 
 if [[ $MANIFEST == "true" ]]; then
-    if [[ ! -f $DOCKER_CLI_CONFIG ]]; then 
-      echo '{"experimental":"enabled"}' > $DOCKER_CLI_CONFIG
+    if [[ ! -f "$DOCKER_CLI_CONFIG" ]]; then 
+      echo '{"experimental":"enabled"}' > "$DOCKER_CLI_CONFIG"
       echo "Created docker config file"
     fi
-    cat <<< $(jq '.+{"experimental":"enabled"}' $DOCKER_CLI_CONFIG) > $DOCKER_CLI_CONFIG
+    # shellcheck disable=SC2046,SC2094 # This pattern works despite shellcheck warnings
+    cat <<< "$(jq '.+{"experimental":"enabled"}' "$DOCKER_CLI_CONFIG")" > "$DOCKER_CLI_CONFIG"
     echo "Enabled experimental CLI features to create the docker manifest"
-    docker manifest create $IMAGE_REPO:$VERSION $MANIFEST_IMAGES
+    # shellcheck disable=SC2086 # MANIFEST_IMAGES intentionally contains space-separated values
+    docker manifest create "$IMAGE_REPO:$VERSION" $MANIFEST_IMAGES
 
     for os_arch in "${PLATFORMS[@]}"; do
-        os=$(echo $os_arch | cut -d'/' -f1)
-        arch=$(echo $os_arch | cut -d'/' -f2)
+        os=$(echo "$os_arch" | cut -d'/' -f1)
+        arch=$(echo "$os_arch" | cut -d'/' -f2)
 
         img_tag="$IMAGE_REPO:$VERSION-$os-$arch"
 
-        docker manifest annotate $IMAGE_REPO:$VERSION $img_tag --arch $arch --os $os
+        docker manifest annotate "$IMAGE_REPO:$VERSION" "$img_tag" --arch "$arch" --os "$os"
     done
 
-    docker manifest push $IMAGE_REPO:$VERSION
+    docker manifest push "$IMAGE_REPO:$VERSION"
 fi
@@ -11,7 +11,7 @@ if git --no-pager diff --name-only HEAD^ HEAD | grep 'README.md'; then
         -d '{"username": "'"${DOCKERHUB_USERNAME}"'", "password": "'"${DOCKERHUB_PASSWORD}"'"}' \
         https://hub.docker.com/v2/users/login/ | jq -r .token)
 
-    rcode=$(jq -n --arg msg "$(<$SCRIPTPATH/../README.md)" \
+    rcode=$(jq -n --arg msg "$(<"$SCRIPTPATH"/../README.md)" \
         '{"registry":"registry-1.docker.io","full_description": $msg }' | 
             curl -s -o /dev/stderr -L -w "%{http_code}" \
             https://hub.docker.com/v2/repositories/"${image}"/ \