ci: Clean up scripts

.github/.cspell/project-dictionary.txt

@@ -24,6 +24,7 @@ protoc
 pwsh
 quickinstall
 rclone
+rootfs
 sccache
 syft
 udeps

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ env:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
@@ -84,7 +84,7 @@ jobs:
     steps:
       - uses: taiki-e/checkout-action@v1
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
-      - run: rm Cargo.toml
+      - run: rm -- Cargo.toml
       - name: Generate tool list
         id: tool-list
         run: tools/ci/tool-list.sh "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.bash }}" >>"${GITHUB_OUTPUT}"
@@ -159,13 +159,13 @@ jobs:
           - opensuse/tumbleweed:latest # glibc 2.39 (as of 2024-07-19)
           - archlinux:latest # glibc 2.39 (as of 2024-07-19)
           - alpine:latest # musl 1.2.5 (as of alpine 3.20)
+          # - openwrt/rootfs:x86-64-openwrt-24.10 # musl 1.2.5
     runs-on: ubuntu-latest
     timeout-minutes: 60
     container: ${{ matrix.container }}
     steps:
       - name: Install requirements (old debian)
         run: |
-          set -CeEuxo pipefail
           # In Debian, the old repositories is removed from the main mirrors some time after EoL.
           sed -i /etc/apt/sources.list -e 's/deb.debian.org/archive.debian.org/g' \
             -e 's|security.debian.org|archive.debian.org/|g' \
@@ -173,7 +173,6 @@ jobs:
         if: startsWith(matrix.container, 'debian:9')
       - name: Install requirements (centos)
         run: |
-          set -CeEuxo pipefail
           # In CentOS, the old repositories is removed from the main mirrors just after EoL.
           # https://github.com/rust-lang/rust/pull/126352
           sed -i /etc/yum.repos.d/*.repo -e 's!^mirrorlist!#mirrorlist!' \
@@ -196,7 +195,7 @@ jobs:
         if: startsWith(matrix.container, 'centos')
       - uses: taiki-e/checkout-action@v1
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
-      - run: rm Cargo.toml
+      - run: rm -- Cargo.toml
       - name: Generate tool list
         id: tool-list
         run: tools/ci/tool-list.sh >>"${GITHUB_OUTPUT}"
@@ -209,6 +208,16 @@ jobs:
           tool: ${{ steps.tool-list.outputs.tool }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Test bash
+        run: just --version && shfmt --version
+        shell: bash
+        # TODO: OCI runtime exec failed: exec failed: unable to start container process: exec: "bash": executable file not found in $PATH: unknown
+        if: (!startsWith(matrix.container, 'opensuse'))
+      - name: Test sh
+        run: just --version && shfmt --version
+        shell: sh
+        # TODO: OCI runtime exec failed: exec failed: unable to start container process: exec: "sh": executable file not found in $PATH: unknown
+        if: (!startsWith(matrix.container, 'opensuse'))
 
   manifest:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -10,7 +10,7 @@ on:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
 
 jobs:
   create-release:

tools/ci/manifest.sh

@@ -1,11 +1,12 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: Apache-2.0 OR MIT
-set -eEuo pipefail
+set -CeEuo pipefail
 IFS=$'\n\t'
-cd "$(dirname "$0")"/../..
+trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
+cd -- "$(dirname -- "$0")"/../..
 
 bail() {
-    echo >&2 "error: $*"
+    printf >&2 'error: %s\n' "$*"
     exit 1
 }
 
@@ -13,15 +14,17 @@ if [[ -z "${CI:-}" ]]; then
     bail "this script is intended to call from release workflow on CI"
 fi
 
-git config user.name "Taiki Endo"
-git config user.email "te316e89@gmail.com"
+git config user.name 'Taiki Endo'
+git config user.email 'te316e89@gmail.com'
 
 set -x
 
+has_update=''
 for manifest in manifests/*.json; do
     git add -N "${manifest}"
     if ! git diff --exit-code -- "${manifest}"; then
-        name=$(basename "${manifest%.*}")
+        name="${manifest##*/}"
+        name="${name%.*}"
         git stash
         old_version=$(jq -r '.latest.version' "${manifest}")
         git stash pop
@@ -29,7 +32,7 @@ for manifest in manifests/*.json; do
         if [[ "${old_version}" != "${new_version}" ]]; then
             # TODO: If there is a line about updating the same tool in the "Unreleased" section, replace it.
             msg="Update \`${name}@latest\` to ${new_version}"
-            sed -i "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n- ${msg}./" CHANGELOG.md
+            sed -Ei "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n- ${msg}./" CHANGELOG.md
             git add "${manifest}" CHANGELOG.md
         else
             msg="Update ${name} manifest"
@@ -40,6 +43,6 @@ for manifest in manifests/*.json; do
     fi
 done
 
-if [[ -n "${has_update:-}" ]] && [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-    echo "success=false" >>"${GITHUB_OUTPUT}"
+if [[ -n "${has_update}" ]] && [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+    printf 'success=false\n' >>"${GITHUB_OUTPUT}"
 fi

tools/ci/tool-list.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: Apache-2.0 OR MIT
-set -eEuo pipefail
+set -CeEuo pipefail
 IFS=$'\n\t'
-cd "$(dirname "$0")"/../..
+trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
+cd -- "$(dirname -- "$0")"/../..
 
 # They don't provide prebuilt binaries for musl or old glibc host.
 # version `GLIBC_2.34' not found
@@ -53,7 +54,7 @@ case "${1:-}" in
         incompat_tools+=(valgrind cargo-binstall)
         ;;
     *)
-        echo "tool=$1"
+        printf 'tool=%s\n', "$1"
         exit 1
         ;;
 esac
@@ -63,7 +64,7 @@ case "$(uname -s)" in
     Linux)
         host_os=linux
         ldd_version=$(ldd --version 2>&1 || true)
-        if grep <<<"${ldd_version}" -q 'musl'; then
+        if grep -Fq musl <<<"${ldd_version}"; then
             incompat_tools+=("${musl_incompat[@]}")
         else
             host_glibc_version=$(grep -E "GLIBC|GNU libc" <<<"${ldd_version}" | sed "s/.* //g")
@@ -92,7 +93,7 @@ case "$(uname -s)" in
                 fi
             fi
         fi
-        if ! type -P snap &>/dev/null; then
+        if ! type -P snap >/dev/null; then
             incompat_tools+=(valgrind)
         fi
         ;;
@@ -112,9 +113,10 @@ esac
 
 tools=()
 for manifest in tools/codegen/base/*.json; do
-    tool_name=$(basename "${manifest%.*}")
+    tool_name="${manifest##*/}"
+    tool_name="${tool_name%.*}"
     # cross -V requires rustc
-    if [[ "${tool_name}" == "cross" ]] && ! type -P rustc &>/dev/null; then
+    if [[ "${tool_name}" == "cross" ]] && ! type -P rustc >/dev/null; then
         continue
     fi
     case "${host_os}" in
@@ -133,7 +135,7 @@ for manifest in tools/codegen/base/*.json; do
     done
     if [[ -n "${tool_name}" ]]; then
         if [[ "${version}" != "latest" ]]; then
-            latest_version=$(jq -r ".latest.version" "manifests/${tool_name}.json")
+            latest_version=$(jq -r '.latest.version' "manifests/${tool_name}.json")
             case "${version}" in
                 major.minor.patch) tool_name+="@${latest_version}" ;;
                 major.minor) tool_name+="@${latest_version%.*}" ;;
@@ -159,7 +161,7 @@ case "${host_os}" in
     linux*)
         # Installing snap to container is difficult...
         # Specifying the version of valgrind is not supported.
-        if type -P snap &>/dev/null && [[ "${version}" == "latest" ]]; then
+        if type -P snap >/dev/null && [[ "${version}" == "latest" ]]; then
             tools+=(valgrind)
         fi
         ;;
@@ -181,5 +183,5 @@ IFS=$'\n\t'
 
 # TODO: inject random space before/after of tool name for testing https://github.com/taiki-e/install-action/issues/115.
 IFS=','
-echo "tool=${tools[*]}"
+printf 'tool=%s\n' "${tools[*]}"
 IFS=$'\n\t'