Adopt 'set -Eeuo pipefail' on every bash surface (#338) - #350
Merged
Conversation
The hub was internally consistent on 'set -euo pipefail' (AGENTS.md rule and configure.sh agreed); the '-Eeuo' mandate #338 cites lives in a downstream carried AGENTS.md that drifted from the hub. Rather than change the canonical script to match a drifted copy, adopt -Eeuo at the hub as the better default and let the carries converge on it. -E makes an ERR trap inherit into functions, subshells, and command substitutions. The fleet ships no ERR trap today, so this is defense in depth: a script that later adds one inherits the behavior instead of silently losing it. Swept all 26 occurrences: hub workflows, repo-config/configure.sh, the catalog workflow snippets, and both devcontainer post-create.sh scripts. The AGENTS.md rule prose also resolves the scope ambiguity #338 raises - it now covers "every bash surface: a multi-line run: block and every committed .sh script alike", so inline snippets are explicitly in scope; WORKFLOW.md D9.3 and the style bullet match. Verified: shellcheck + bash -n clean on all three scripts; actionlint clean on the hub workflows; configure.sh still resolves both models (release and operational) in place; markdownlint, editorconfig-checker, spec/validate.py, and CI-scoped cspell all clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the repository's bash "strict mode" convention to include -E (errtrace) and applies it across documented guidance, GitHub Actions workflow run: | blocks, reusable workflow snippets, and committed .sh scripts to keep the hub and downstream carries consistent (see issue #338).
Changes:
- Update governance docs (AGENTS.md, WORKFLOW.md) to define
set -Eeuo pipefailfor every bash surface (multi-linerun:and.shfiles). - Replace
set -euo pipefailwithset -Eeuo pipefailacross the hub workflows, catalog workflow snippets, and devcontainer post-create scripts. - Update
repo-config/configure.shto match the new convention.
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| WORKFLOW.md | Updates workflow style guarantees to require set -Eeuo pipefail for multi-line bash run: and .sh scripts. |
| AGENTS.md | Updates the canonical bash-surface rule and documents the rationale for -E inheritance behavior. |
| repo-config/configure.sh | Switches the script's strict-mode header to set -Eeuo pipefail. |
| .github/workflows/validate-task.yml | Updates the multi-line bash validation step to start with set -Eeuo pipefail. |
| .github/workflows/test-pull-request.yml | Updates the required-check aggregator's multi-line bash step to start with set -Eeuo pipefail. |
| .github/workflows/publish-release.yml | Updates the dispatch ref assertion step to start with set -Eeuo pipefail. |
| .github/workflows/merge-bot-pull-request.yml | Updates all multi-line merge steps to start with set -Eeuo pipefail. |
| catalog/snippets/workflows/run-codegen-pull-request-task.yml | Updates multi-line codegen/format steps to start with set -Eeuo pipefail. |
| catalog/snippets/workflows/publish-plan-task.yml | Updates the plan job's multi-line bash to start with set -Eeuo pipefail. |
| catalog/snippets/workflows/publish-docker-readme-task.yml | Updates all multi-line bash steps (validation, list resolution, optional transform) to start with set -Eeuo pipefail. |
| catalog/snippets/workflows/check-upstream-version-task.yml | Updates the resolver run block to start with set -Eeuo pipefail. |
| catalog/snippets/workflows/build-release-task.yml | Updates multi-line bash steps to start with set -Eeuo pipefail. |
| catalog/snippets/workflows/build-pypilibrary-task.yml | Updates multi-line bash steps to start with set -Eeuo pipefail. |
| catalog/snippets/workflows/build-nugetlibrary-task.yml | Updates multi-line bash steps to start with set -Eeuo pipefail. |
| catalog/snippets/devcontainer/python/post-create.sh | Updates script strict mode to set -Eeuo pipefail. |
| catalog/snippets/devcontainer/dotnet/post-create.sh | Updates script strict mode to set -Eeuo pipefail. |
Strengthening the rule to "every bash surface" left one hub snippet non-compliant: catalog/snippets/workflows/build-executable-task.yml had a multi-line run: block starting straight at dotnet publish. Added set -Eeuo pipefail as its first line so the hub matches the rule it documents. Re-scanned every *.yml: no multi-line bash run: block lacks the line now. actionlint clean; LF preserved. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Jul 18, 2026
ptr727
added a commit
that referenced
this pull request
Jul 19, 2026
Adopts **item 2** of #357, in the sections the owner chose. Item 1 is #360. ## Comments: no header summary blocks > **No class-, type-, or file-header summary comment blocks.** A type or file gets a comment only for a specific non-obvious point, kept terse. Placed in `AGENTS.md` "Comments", which already bans design narrative, rule citations, and verbosity creep - a header summary is the same failure at file scope: it restates the declaration below it and goes stale as the file grows. **One carve-out added:** a licence or provenance header that a tool or policy requires is not a summary, so it is unaffected. That was the only real objection to a blanket ban. ## Character Set: no clause-joining semicolons > **No semicolon joining two independent clauses in agent-authored prose** - documentation, comments, commit messages, and PR descriptions. Placed beside the ASCII/em-dash rules, as the same class of house-style constraint on agent prose habits. **Written to the proposal's actual scope.** It says "as sentence separators", which is narrower than all semicolons, so the rule bans the clause-joining use and explicitly preserves two legitimate ones: a semicolon separating items in a list that already contains commas, and a statement terminator in code. ## On sweeping existing prose I measured before writing the rule, because a rule the hub immediately violates is the trap this repo hit with `set -Eeuo` (#338/#350): ```text AGENTS.md 79 WORKFLOW.md 80 CODESTYLE.md 33 AUDIT.md 22 copilot-instructions 16 README.md 9 STANDUP.md 5 repo-config/README 4 TOTAL 248 prose lines containing a semicolon ``` Not all are clause-joining - many are list separators the rule preserves - but a full sweep would still be a sprawling rewrite of dense governance prose with real risk of changing meaning in text that is load-bearing. So the rule states that **existing prose is corrected as each file is next edited, not swept**. That matches how the fleet already handles propagation debt, and it is honest about the hub's current state rather than pretending compliance. Flagging plainly: this changes my own output style going forward, and the 248 lines are a known, deliberate residue rather than an oversight. `spec/validate.py`, markdownlint, editorconfig-checker: clean. CRLF preserved. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #338 - but not as filed. Worth reading the first section before the diff.
The issue's premise was inverted
#338 states the fleet mandates
set -Eeuo pipefailand thatrepo-config/configure.shviolates it. Verified against the hub:AGENTS.mdsaidset -euo pipefail, andconfigure.shused exactly that - they already agreed.-Eeuomandate exists only in HomeAutomation-Config's carriedAGENTS.md, which has drifted from the hub.trap ... ERRanywhere in the fleet, so-Eis functionally inert today.Taking the issue at face value would have changed the canonical hub script to match a drifted downstream copy. Instead, per the owner's call: adopt
-Eeuoat the hub as the better default and let the carries converge on it. (The divergence itself is more evidence for #305.)Changes
set -Eeuo pipefail: the 4 hub workflows,repo-config/configure.sh, the 7 catalog workflow snippets, and both devcontainerpost-create.shscripts.AGENTS.mdrule prose now states the rationale (-Elets anERRtrap inherit into functions/subshells/command substitutions; defense in depth since the fleet ships no trap yet) and resolves the scope ambiguity configure.sh uses 'set -euo pipefail'; fleet AGENTS.md mandates 'set -Eeuo pipefail' #338's last paragraph raises - it covers "every bash surface: a multi-linerun:block and every committed.shscript alike", so inline snippets are explicitly in scope.WORKFLOW.mdstyle bullet and D9.3 match.Verification
bash -nclean on all three scripts.configure.shre-run in place: still resolvesreleaseandoperationalcorrectly.spec/validate.py, CI-scoped cspell: clean. CRLF/LF endings preserved (swept withsed, which leaves line endings untouched).Downstream carries pick this up on their next conformance touch, as usual.
🤖 Generated with Claude Code