refactor(lint): clear shellcheck and regexp findings ahead of enabling the rules (#9586)

* ci(workflows): quote shell expansions in workflow steps

Unquoted expansions split on whitespace, so a runner path, a packed filename, or
a version string containing a space becomes two words. `rm -rf *` additionally
hands any dash-prefixed filename to `rm` as an option.

The redundant `exit` in the actionlint summary step goes too: `fail-on-error`
already fails the job, and the step only runs once the exit code is nonzero, so
the extra `exit` could only pass a value outside 0-255 back to the shell.

* refactor(regexp): drop no-op flags, groups, and escapes

The removed pieces cannot affect which strings match: `m` needs an anchor, `i`
needs a letter, a non-capturing group around a whole pattern or a single
alternative adds nothing, `.*` padding inside a lookahead reached only through
`test()` is unreachable work, a lazy quantifier immediately before `$` has one
possible length, and `{` / `]` are literals either way.

The URL segment matcher gains a case for the 20-character `{param:str}`
threshold, which nothing pinned.

* refactor(regexp): match delimiters without repeated rescanning

Each of these matchers walks the same characters again for every start position
the engine tries, on values whose length is set by whatever produced them. The
replacements examine each character once.

1. Trailing-delimiter trims (`kebabcase` dashes, the cypress source-map query
   strip) drop their quantifiers.
2. `stripColonWhitespace` and `splitHeader` split once and trim each part.
   `splitHeader` now also trims the first and last entry, which the previous
   pattern left alone.
3. The telemetry stack-frame filter bounds its indent to spaces and tabs, so a
   frame can no longer be matched starting from an earlier line.
4. The `@fast-check/jest` seed suffix and the cucumber attempt suffix bound
   their separator to the single space each library emits.

Author: BridgeAR

.github/workflows/flakiness.yml

@@ -49,9 +49,9 @@ jobs:
       - run: node scripts/flakiness.mjs
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
-      - run: cat flakiness.md >> $GITHUB_STEP_SUMMARY
+      - run: cat flakiness.md >> "$GITHUB_STEP_SUMMARY"
       - id: slack
-        run: echo "report=$(cat flakiness.txt)" >> $GITHUB_OUTPUT
+        run: echo "report=$(cat flakiness.txt)" >> "$GITHUB_OUTPUT"
       - uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v2.1.0
         if: github.event_name == 'schedule'
         with:

.github/workflows/mirror-image.yml

@@ -40,7 +40,7 @@ jobs:
           REPOSITORY: ${{ github.repository }}
         run: |
           GHCR_TARGET="$(echo "ghcr.io/${REPOSITORY}/${IMAGE}" | tr '[:upper:]' '[:lower:]')"
-          echo "GHCR_TARGET=${GHCR_TARGET}" >> $GITHUB_ENV
+          echo "GHCR_TARGET=${GHCR_TARGET}" >> "$GITHUB_ENV"
 
       - name: Mirror manifest to GHCR
         env:

.github/workflows/platform.yml

@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/node/active-lts
       - uses: ./.github/actions/install
-      - run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
+      - run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv "/tmp/$FILENAME" /tmp/dd-trace.tgz
       - run: mkdir -p /tmp/app
       - run: npm i -g pnpm
         if: matrix.manager.name == 'pnpm'
@@ -71,7 +71,7 @@ jobs:
       - uses: ./.github/actions/node/active-lts
       - uses: ./.github/actions/install
       - run: mkdir npm bun
-      - run: FILENAME=$(npm pack --silent) && tar -zxf $FILENAME -C npm
+      - run: FILENAME=$(npm pack --silent) && tar -zxf "$FILENAME" -C npm
       - run: ./node_modules/.bin/bun pm pack --gzip-level 0 --filename bun.tgz && tar -zxf bun.tgz -C bun
       - run: diff -r npm bun
 

.github/workflows/project.yml

@@ -34,7 +34,6 @@ jobs:
           echo "actionlint found ${{ steps.actionlint.outputs.total-errors }} errors"
           echo "actionlint checked ${{ steps.actionlint.outputs.total-files }} files"
           echo "actionlint cache used: ${{ steps.actionlint.outputs.cache-hit }}"
-          exit ${{ steps.actionlint.outputs.exit-code }}
 
   lint:
     runs-on: ubuntu-latest
@@ -48,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: docker build -q -t ec .github/editorconfig-checker && docker run --rm --volume=$PWD:/check ec
+      - run: docker build -q -t ec .github/editorconfig-checker && docker run --rm --volume="$PWD":/check ec
 
   release-scripts:
     runs-on: ubuntu-latest
@@ -96,9 +95,9 @@ jobs:
           policy: package-size-report
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/node/latest
-      - run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
-      - run: rm -rf *
-      - run: tar -zxf /tmp/dd-trace.tgz -C $(pwd) --strip-components=1
+      - run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/"$FILENAME" /tmp/dd-trace.tgz
+      - run: rm -rf ./*
+      - run: tar -zxf /tmp/dd-trace.tgz -C "$(pwd)" --strip-components=1
       - run: yarn --prod --ignore-optional
       - run: ls -lisa
       - name: Compute module size tree and report
@@ -174,7 +173,7 @@ jobs:
           set -euo pipefail
 
           if git diff --quiet; then
-            echo "has_changes=false" >> $GITHUB_OUTPUT
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
@@ -211,7 +210,7 @@ jobs:
           fi
 
           cp yarn.lock "${RUNNER_TEMP}/yarn.lock"
-          echo "has_changes=true" >> $GITHUB_OUTPUT
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: steps.diff.outputs.has_changes == 'true'

.github/workflows/release.yml

@@ -87,8 +87,8 @@ jobs:
           registry-url: https://registry.npmjs.org
       - id: pkg
         run: |
-          content=`cat ./package.json | tr '\n' ' '`
-          echo "json=$content" >> $GITHUB_OUTPUT
+          content=$(tr '\n' ' ' < ./package.json)
+          echo "json=$content" >> "$GITHUB_OUTPUT"
       - name: Publish
         run: |
           version="${{ fromJson(steps.pkg.outputs.json).version }}"
@@ -159,8 +159,8 @@ jobs:
       - uses: ./.github/actions/node
       - id: pkg
         run: |
-          content=`cat ./package.json | tr '\n' ' '`
-          echo "json=$content" >> $GITHUB_OUTPUT
+          content=$(tr '\n' ' ' < ./package.json)
+          echo "json=$content" >> "$GITHUB_OUTPUT"
       - run: yarn
       - name: Build
         working-directory: docs
@@ -173,7 +173,7 @@ jobs:
           ref: gh-pages
       - name: Deploy
         run: |
-          rm -rf *
+          rm -rf ./*
           mv /tmp/out/* .
           git config user.name github-actions
           git config user.email github-actions@github.com
@@ -205,9 +205,9 @@ jobs:
       - uses: ./.github/actions/install
       - id: pkg
         run: |
-          content=`cat ./package.json | tr '\n' ' '`
-          echo "json=$content" >> $GITHUB_OUTPUT
-      - run: npm version --no-git-tag-version ${{ fromJson(steps.pkg.outputs.json).version }}-$(git rev-parse --short HEAD)+${{ github.run_id }}.${{ github.run_attempt }}
+          content=$(tr '\n' ' ' < ./package.json)
+          echo "json=$content" >> "$GITHUB_OUTPUT"
+      - run: npm version --no-git-tag-version "${{ fromJson(steps.pkg.outputs.json).version }}-$(git rev-parse --short HEAD)+${{ github.run_id }}.${{ github.run_attempt }}"
       - run: npm publish --tag dev
       - run: |
           git tag --force dev
@@ -233,7 +233,7 @@ jobs:
       - uses: ./.github/actions/install
       - id: pkg
         run: |
-          content=`cat ./package.json | tr '\n' ' '`
-          echo "json=$content" >> $GITHUB_OUTPUT
-      - run: npm version --no-git-tag-version ${{ fromJson(steps.pkg.outputs.json).version }}-$(git rev-parse --short HEAD)+${{ github.run_id }}.${{ github.run_attempt }}
+          content=$(tr '\n' ' ' < ./package.json)
+          echo "json=$content" >> "$GITHUB_OUTPUT"
+      - run: npm version --no-git-tag-version "${{ fromJson(steps.pkg.outputs.json).version }}-$(git rev-parse --short HEAD)+${{ github.run_id }}.${{ github.run_attempt }}"
       - run: node scripts/release/publish-electron.js --tag dev

.github/workflows/system-tests.yml

@@ -22,7 +22,7 @@ jobs:
         with:
           path: dd-trace-js
       - name: Pack dd-trace-js
-        run: mkdir -p ./binaries && echo /binaries/$(npm pack --silent --pack-destination ./binaries ./dd-trace-js) > ./binaries/nodejs-load-from-npm
+        run: mkdir -p ./binaries && echo "/binaries/$(npm pack --silent --pack-destination ./binaries ./dd-trace-js)" > ./binaries/nodejs-load-from-npm
       - name: Upload artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

.github/workflows/test-optimization.yml

@@ -61,7 +61,7 @@ jobs:
             versions.getLatestPlaywrightSpecifier() === 'latest' \
               ? versions.latest \
               : versions.latestSupportedByNode18")
-          echo "version=$PLAYWRIGHT_VERSION" >> $GITHUB_OUTPUT
+          echo "version=$PLAYWRIGHT_VERSION" >> "$GITHUB_OUTPUT"
           echo "Playwright version: $PLAYWRIGHT_VERSION"
       - name: Cache Playwright browsers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -117,9 +117,11 @@ jobs:
               IMAGE_TAG="$OLDEST_TAG"
               ;;
           esac
-          echo "images=$IMAGES" >> $GITHUB_OUTPUT
-          echo "pw-version=$PW_VERSION" >> $GITHUB_OUTPUT
-          echo "image-tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+          {
+            echo "images=$IMAGES"
+            echo "pw-version=$PW_VERSION"
+            echo "image-tag=$IMAGE_TAG"
+          } >> "$GITHUB_OUTPUT"
       - name: Log in to GHCR
         uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
@@ -352,7 +354,7 @@ jobs:
         run: |
           DOCKER_HASH=$(sha256sum .github/selenium/Dockerfile | cut -c1-8)
           IMAGE="ghcr.io/datadog/dd-trace-js/selenium-tools:${DOCKER_HASH}"
-          echo "image=$IMAGE" >> $GITHUB_OUTPUT
+          echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
       - name: Log in to GHCR
         uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
@@ -472,7 +474,7 @@ jobs:
           else
             RESOLVED="${{ matrix.cypress-version }}"
           fi
-          echo "resolved=$RESOLVED" >> $GITHUB_OUTPUT
+          echo "resolved=$RESOLVED" >> "$GITHUB_OUTPUT"
       - name: Cache Cypress binary
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:

.github/workflows/update-3rdparty-licenses.yml

@@ -90,20 +90,20 @@ jobs:
         run: |
           set -e
 
-          echo "head_oid=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
+          echo "head_oid=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
 
           if git diff --ignore-space-at-eol --exit-code LICENSE-3rdparty.csv; then
             echo "✅ LICENSE-3rdparty.csv is already up to date"
-            echo "needs_update=false" >> $GITHUB_OUTPUT
+            echo "needs_update=false" >> "$GITHUB_OUTPUT"
           else
             echo "📝 LICENSE-3rdparty.csv was modified by license attribution command"
-            echo "needs_update=true" >> $GITHUB_OUTPUT
+            echo "needs_update=true" >> "$GITHUB_OUTPUT"
           fi
 
           if [[ "$PR_USER_TYPE" == "Bot" ]] && [[ "$PR_HEAD_REPO" == "$BASE_REPO" ]]; then
-            echo "is_bot_same_repo=true" >> $GITHUB_OUTPUT
+            echo "is_bot_same_repo=true" >> "$GITHUB_OUTPUT"
           else
-            echo "is_bot_same_repo=false" >> $GITHUB_OUTPUT
+            echo "is_bot_same_repo=false" >> "$GITHUB_OUTPUT"
           fi
 
           # Release proposal branches are built by cherry-picking master onto a release
@@ -113,9 +113,9 @@ jobs:
           # fail loudly instead — the license CSV is already correct on master and should
           # never need attribution work done directly on a proposal branch.
           if [[ "$HEAD_REF" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-proposal$ ]]; then
-            echo "is_release_proposal=true" >> $GITHUB_OUTPUT
+            echo "is_release_proposal=true" >> "$GITHUB_OUTPUT"
           else
-            echo "is_release_proposal=false" >> $GITHUB_OUTPUT
+            echo "is_release_proposal=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Upload updated LICENSE-3rdparty.csv

integration-tests/esbuild/index.spec.js

@@ -145,7 +145,7 @@ esbuildVersions.forEach((version) => {
         })
 
         const builtFile = readFileSync('./out.mjs').toString()
-        assert.match(builtFile, /\/\* js test \*\//m)
+        assert.match(builtFile, /\/\* js test \*\//)
       })
 
       it('should contain the definitions when esm is inferred from outfile', () => {
@@ -154,7 +154,7 @@ esbuildVersions.forEach((version) => {
         })
 
         const builtFile = readFileSync('./out.mjs').toString()
-        assert.match(builtFile, /globalThis\.__filename \?\?= \$dd_fileURLToPath\(import\.meta\.url\);/m)
+        assert.match(builtFile, /globalThis\.__filename \?\?= \$dd_fileURLToPath\(import\.meta\.url\);/)
       })
 
       it('should contain the definitions when esm is inferred from format', () => {
@@ -163,7 +163,7 @@ esbuildVersions.forEach((version) => {
         })
 
         const builtFile = readFileSync('./out.mjs').toString()
-        assert.match(builtFile, /globalThis\.__filename \?\?= \$dd_fileURLToPath\(import\.meta\.url\);/m)
+        assert.match(builtFile, /globalThis\.__filename \?\?= \$dd_fileURLToPath\(import\.meta\.url\);/)
       })
 
       it('should contain the definitions when format is inferred from out extension', () => {
@@ -172,7 +172,7 @@ esbuildVersions.forEach((version) => {
         })
 
         const builtFile = readFileSync('./basic-test.mjs').toString()
-        assert.match(builtFile, /globalThis\.__filename \?\?= \$dd_fileURLToPath\(import\.meta\.url\);/m)
+        assert.match(builtFile, /globalThis\.__filename \?\?= \$dd_fileURLToPath\(import\.meta\.url\);/)
       })
 
       it('should not contain the definitions when no esm is specified', () => {
@@ -181,7 +181,7 @@ esbuildVersions.forEach((version) => {
         })
 
         const builtFile = readFileSync('./out.js').toString()
-        assert.doesNotMatch(builtFile, /globalThis\.__filename \?\?= \$dd_fileURLToPath\(import\.meta\.url\);/m)
+        assert.doesNotMatch(builtFile, /globalThis\.__filename \?\?= \$dd_fileURLToPath\(import\.meta\.url\);/)
       })
 
       it('should not crash when it is already patched using global', () => {

integration-tests/package-guardrails.spec.js

@@ -136,7 +136,7 @@ addHook({ name: 'bluebird', versions: ['*'] }, Promise => {
           log => {
             assert.match(
               log,
-              /\nError during ddtrace instrumentation of application, aborting.\nReferenceError: this is a test error\n {4}at /m
+              /\nError during ddtrace instrumentation of application, aborting.\nReferenceError: this is a test error\n {4}at /
             )
             assert.match(log, /\nfalse\n/)
           }, []))