[bug] cut-standards-release.sh dies on bash 3.2 (${out,,}) mid-cut — leaves release published with no channel tag

[don-petry]

Summary

scripts/cut-standards-release.sh aborts mid-write on bash 3.2 (the macOS system bash), leaving the release channel in a partially-cut state: the immutable release tag is created, the moving channel tag is not.

Hit on the very first real use of the script — cutting standards/v1.0.0 on 2026-09-13.

Reproduction

$ bash --version
GNU bash, version 3.2.57(1)-release (arm64-apple-darwin25)

$ bash scripts/cut-standards-release.sh cut v1.0.0 --commit 782e005f8359...
repo:      petry-projects/.github
release:   standards/v1.0.0 -> 782e005f8359
channel:   standards/v1-stable -> 782e005f8359
decision:  CREATE
creating immutable release standards/v1.0.0 at 782e005f8359...
moving channel standards/v1-stable onto 782e005f8359...
scripts/cut-standards-release.sh: line 275: ${out,,}: bad substitution

Cause

_gh_move_tag() (line ~275) lowercases the API error with ${out,,}:

out="$(gh api -X PATCH "repos/$repo/git/refs/tags/$tag" -f sha="$sha" -F force=true 2>&1)" && return 0
low="${out,,}"        # <-- bash 4+ only

${var,,} is a bash 4.0 case-modification expansion. On bash 3.2 it is a syntax error, and under set -euo pipefail the script dies immediately.

The expansion is only used for case-insensitive matching of a "not found" / 404 message to decide PATCH-vs-POST — so the failure happens on the create path, which is exactly the path a first-ever cut takes.

Why the partial state is the real problem

The script's stated contract is that cutting is "a scripted, idempotent, clobber-refusing operation instead of a one-off hand action". On bash 3.2 it is not atomic: it created standards/v1.0.0 and then died before creating standards/v1-stable. Observed state afterwards:

standards/v1.0.0     -> annotated tag -> 782e005f8359...   (created)
standards/v1-stable  -> 404                                 (missing)

An immutable release that consumers cannot reach through the channel they pin. And because the release tag is clobber-refusing by design, a naive re-run does not repair it — it correctly reports NOOP on the release while the channel stays absent.

In this instance the channel was completed manually via the same POST /git/refs call the script's own fallback performs, and the result verifies:

$ bash scripts/cut-standards-release.sh resolve
current:  standards/v1.0.0   (channel standards/v1-stable)

Acceptance criteria

1. Runs on bash 3.2. Replace ${out,,} with a portable lowercase (tr '[:upper:]' '[:lower:]') or a case-insensitive match, and sweep the file for other bash 4+ constructs (${x^^}, declare -A, mapfile/readarray, &>>).
2. A failed channel move does not leave a published release stranded. Either the cut is ordered/recoverable so a re-run completes the channel (the current NOOP path should still ensure the channel is aligned, which the dry-run text already claims it does), or the failure is reported loudly enough that the operator knows a manual step remains. Silent partial success is the defect.
3. A regression test runs the script under bash 3.2 semantics, or CI lints for bash 4+ constructs in scripts/**. This script is operator-run from a workstation, so "CI uses newer bash" is not sufficient coverage — macOS is the likely execution environment.
4. The existing published state is left intact. standards/v1.0.0 and standards/v1-stable both resolve to 782e005f8359... today and must not be clobbered or re-pointed by the fix.
5. Idempotency is preserved and proven: re-running the cut at the same commit stays NOOP on the release and still converges the channel.

Out of scope

• Changing the release/channel naming or the N-1 policy (#1448).
• Automating when a cut happens — a human still decides that.

Dev Notes

• Same portability class as the sed -i and date -u -d findings raised on #1742 and elsewhere: GNU-only constructs in scripts that are actually run on macOS. Worth checking whether scripts/lib/standards-release.sh (the pure core) has the same issue — the failure here was in the thin I/O glue, which is less well covered by tests/standards_release.bats.
• canary-rollout.sh has a sibling _gh_move_tag; check whether it carries the same construct, since it is the pattern this script mirrored.

---

Observed 2026-09-13 cutting the first standards release (#1091 / PR #1094).

[don-petry]

Dev-Lead Implementation Plan

Issue: #1119 — [bug] cut-standards-release.sh dies on bash 3.2 (${out,,}) mid-cut — leaves release published with no channel tag

Scope

Make scripts/cut-standards-release.sh run on bash 3.2 (the macOS system bash) by replacing the bash-4-only ${out,,} case-modification expansion with a portable lowercase, and make a failed channel move surface loudly with a recovery hint so a first-ever cut can never silently strand a published release with no channel tag.

Root cause

_gh_move_tag() lowercases the API error with low="${out,,}" (bash 4.0 case-modification). On bash 3.2 this is a fatal "bad substitution"; under set -euo pipefail the script dies after creating the immutable standards/vX.Y.Z release but before moving standards/v<major>-stable — a partial, non-atomic cut.

Implementation Checklist

• scripts/cut-standards-release.sh _gh_move_tag: replace ${out,,} with a portable lowercase (tr '[:upper:]' '[:lower:]'); keep the same 404/not-found matching semantics (AC Addressing PR comments #1)
• scripts/cut-standards-release.sh _cmd_cut: on a failed channel move, emit a loud ::error:: naming the stranded release + channel and pointing to the NOOP-safe re-run that converges the channel; exit non-zero (AC Add multi-agent isolation strategy using git worktrees #2)
• Sweep scripts/cut-standards-release.sh and scripts/lib/standards-release.sh for other bash 4+ constructs (${x^^}, declare -A, mapfile/readarray, &>>) — none other than ${out,,} found; confirm via the new regression test
• Note (no change): scripts/canary-rollout.sh has a sibling _gh_move_tag with ${out,,}, but that script already requires bash 4+ (extensive declare -A/mapfile) and is CI-run, not operator-run on macOS — out of scope for a bash 3.2 fix; documented in the report

Tests to Write (tests/standards_release.bats)

• Regression lint: assert cut-standards-release.sh + standards-release.sh contain no bash 4+ constructs (${,,}/${^^}, declare -A, mapfile/readarray, &>>) — this is the red test (currently fails on ${out,,}) and gives macOS/bash-3.2 coverage that "CI uses newer bash" cannot (AC Add coding standards & principles section to AGENTS.md #3)
• Behavioural: a fresh cut CREATEs the release and moves the channel (PATCH→404→POST create) — proves no partial state (AC Add multi-agent isolation strategy using git worktrees #2)
• Behavioural: re-running the same cut is NOOP on the release and still converges the channel (AC Add stacked PR strategy and Epic-level workflow guidance #5)

Existing state preserved

No git tags are created or re-pointed by this change (AC #4) — the fix is script portability + tests only; standards/v1.0.0 and standards/v1-stable are untouched.

Test Command

GH_TOKEN=dummy-token bats --print-output-on-failure tests/standards_release.bats and bash .dev-lead/scripts/dev-lead-lint.sh

[don-petry]

Dev-Lead: Progress (in progress — not yet durable)

Provisional. Nothing is pushed yet; the automation posts the authoritative
completion record (with PR number + head SHA) after the push. Treat the notes
below as intent, not delivered results.

Plan Execution (intended)

• Replaced the bash-4 _gh_move_tag lowercase expansion with a POSIX tr lowercase in scripts/cut-standards-release.sh, preserving the case-insensitive 404/not-found → POST-fallback semantics.
• Made a failed channel move in _cmd_cut fail loudly: it names the now-stranded release + channel and points to the NOOP-safe re-run that converges the channel (never re-creating/clobbering the release).
• Swept scripts/cut-standards-release.sh and scripts/lib/standards-release.sh for other bash 4+ constructs (${x^^}/${x,,}, declare -A/local -A, mapfile/readarray, &>>) — the only one present was the reported ${out,,}; the pure core was already clean.
• Added a bats regression test that statically rejects bash 4+ constructs in both operator scripts (macOS/bash-3.2 coverage that a newer CI bash cannot provide), plus two behavioural tests: a fresh cut creates the release AND moves the channel in one run, and a re-run stays NOOP on the release while still converging the channel.

Notes on scope

• scripts/canary-rollout.sh has a sibling _gh_move_tag with the same ${out,,} construct (per the issue Dev Notes). Left unchanged intentionally: that script already requires bash 4+ (extensive declare -A and mapfile) and is CI-run, not operator-run on macOS — a one-line ${out,,} fix would not make it bash-3.2-safe and a full port is out of scope for [bug] cut-standards-release.sh dies on bash 3.2 (${out,,}) mid-cut — leaves release published with no channel tag #1119.
• No git tags are created or re-pointed by this change (AC Add workflow, environment, and orchestration guidance #4) — standards/v1.0.0 and standards/v1-stable are untouched; the change is script portability + tests only.

Local check output (provisional — NOT the pushed run)

GH_TOKEN=dummy-token bats tests/standards_release.bats   → all tests ok (incl. new 25/26/27)
shellcheck --severity=warning -x scripts/cut-standards-release.sh scripts/lib/standards-release.sh → clean
bash .dev-lead/scripts/dev-lead-lint.sh → all checks passed

The durable record (PR + head SHA) follows the push.

[don-petry]

Dev-Lead: Implementation Complete — PR #1127

The implementation for issue #1119 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

• Pull request: feat: implement issue #1119 — [bug] cut-standards-release.sh dies on bash 3.2 (${out,,}) mid-cut — leaves release published with no channel tag #1127
• Head commit: 8d10a07ba797e5a255c1be46aef1e8868bd91ec2
• Run: https://github.com/petry-projects/.github/actions/runs/34737868368

Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.