fix: harden shell scripts and fix db_copy loop bug (#3159)

* fix: harden shell scripts and fix db_copy loop bug

Correct a logic error in hack/db_copy.sh that caused every database
migration to target backstage_plugin_app, and apply shellcheck-driven
hardening across plugin-infra setup scripts and Tekton inline scripts.

Assisted-by: cursor
Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: rename gitops-secret-setup functions to snake_case

Address SonarCloud warnings about camelCase function names introduced
during shell script hardening.

Assisted-by: cursor
Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: resolve SonarCloud shell script findings

Use snake_case function names and bash [[ ]] conditionals throughout
gitops-secret-setup.sh; align plugin-infra.sh file test with [[ ]].

Assisted-by: cursor
Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: regenerate bundle manifests

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rhdh-bot

bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml

@@ -174,8 +174,9 @@ spec:
       image: registry.access.redhat.com/ubi9-minimal
       workingDir: $(workspaces.workflow-source.path)
       script: |
-        ROOT=/workspace/workflow
-        TARGET=flat
+        #!/usr/bin/env sh
+        set -eu
+
         mkdir -p flat
 
         if [ -d "workflow/$(params.workflowId)" ]; then
@@ -186,7 +187,7 @@ spec:
           cp workflow/LICENSE flat/$(params.workflowId)
         fi
 
-        if [ "$(params.convertToFlat)" == "false" ]; then
+        if [ "$(params.convertToFlat)" = "false" ]; then
           rm -rf workflow/src/main/resources
           mv workflow/src flat/$(params.workflowId)/
         fi
@@ -212,6 +213,9 @@ spec:
       image: registry.access.redhat.com/ubi9-minimal
       workingDir: $(workspaces.workflow-source.path)/flat/$(params.workflowId)
       script: |
+        #!/usr/bin/env sh
+        set -eu
+
         microdnf install -y tar gzip
         KN_CLI_URL="https://developers.redhat.com/content-gateway/file/pub/cgw/serverless-logic/1.38.0/kn-workflow-linux-amd64.tar.gz"
         curl -L "$KN_CLI_URL" | tar -xz --no-same-owner && chmod +x kn-workflow-linux-amd64 && mv kn-workflow-linux-amd64 kn-workflow
@@ -237,10 +241,13 @@ spec:
       image: registry.access.redhat.com/ubi9-minimal
       workingDir: $(workspaces.workflow-gitops.path)/workflow-gitops
       script: |
-        cp $(workspaces.workflow-source.path)/flat/$(params.workflowId)/manifests/* kustomize/base
+        #!/usr/bin/env sh
+        set -eu
+
+        cp "$(workspaces.workflow-source.path)/flat/$(params.workflowId)/manifests/"* kustomize/base
         microdnf install -y findutils && microdnf clean all
-        cd kustomize
-        ./updater.sh $(params.workflowId) $(params.imageTag)
+        cd kustomize || exit
+        ./updater.sh "$(params.workflowId)" "$(params.imageTag)"
 ---
 apiVersion: tekton.dev/v1
 kind: Pipeline

bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml

@@ -3,13 +3,17 @@
 # Setup Script for RHDH Authentication For Orchestrator CICD
 #
 
-function captureRHDHNamespace {
+set -euo pipefail
+
+selected_instance=""
+
+capture_rhdh_namespace() {
   default="rhdh"
-  if [ "$use_default" == true ]; then
+  if [[ "$use_default" == true ]]; then
     rhdh_workspace="$default"
   else
     read -rp "Enter RHDH Instance namespace (default: $default): " value
-    if [ -z "$value" ]; then
+    if [[ -z "$value" ]]; then
         rhdh_workspace="$default"
     else
         rhdh_workspace="$value"
@@ -18,14 +22,14 @@ function captureRHDHNamespace {
   RHDH_NAMESPACE=$rhdh_workspace
 }
 
-function captureArgoCDNamespace {
+capture_argocd_namespace() {
   default="openshift-gitops-operator"
-  if [ "$use_default" == true ]; then
+  if [[ "$use_default" == true ]]; then
     argocd_namespace="$default"
   else
     read -rp "Enter ArgoCD installation namespace (default: $default): " value
 
-    if [ -z "$value" ]; then
+    if [[ -z "$value" ]]; then
         argocd_namespace="$default"
     else
         argocd_namespace="$value"
@@ -34,19 +38,19 @@ function captureArgoCDNamespace {
   ARGOCD_NAMESPACE=$argocd_namespace
 }
 
-function captureArgoCDURL {
+capture_argocd_url() {
   argocd_instances=$(oc get argocd -n "$ARGOCD_NAMESPACE" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')
 
-  if [ -z "$argocd_instances" ]; then
+  if [[ -z "$argocd_instances" ]]; then
       echo "No ArgoCD instances found in namespace $ARGOCD_NAMESPACE. Continuing without ArgoCD support"
   else
-    if [ "$use_default" == true ]; then
+    if [[ "$use_default" == true ]]; then
           selected_instance=$(echo "$argocd_instances" | awk 'NR==1')
           echo "Select an ArgoCD instance: $selected_instance"
     else
       echo "Select an ArgoCD instance:"
       select instance in $argocd_instances; do
-          if [ -n "$instance" ]; then
+          if [[ -n "$instance" ]]; then
               selected_instance="$instance"
               break
           else
@@ -56,21 +60,21 @@ function captureArgoCDURL {
     fi
     argocd_route=$(oc get route -n "$ARGOCD_NAMESPACE" -l app.kubernetes.io/managed-by="$selected_instance" -ojsonpath='{.items[0].status.ingress[0].host}')
     echo "Found Route at $argocd_route"
-    ARGOCD_URL=https://$argocd_route
+    ARGOCD_URL="https://${argocd_route}"
   fi
 
 }
 
-function captureArgoCDCreds {
-  if [ -n "$selected_instance" ]; then
+capture_argocd_creds() {
+  if [[ -n "$selected_instance" ]]; then
     admin_password=$(oc get secret -n "$ARGOCD_NAMESPACE" "${selected_instance}"-cluster -ojsonpath='{.data.admin\.password}' | base64 -d)
     ARGOCD_USERNAME="admin"
     ARGOCD_PASSWORD=$admin_password
   fi
 }
 
-function captureGitToken {
-   if [ -z "$GITHUB_TOKEN" ]; then
+capture_git_token() {
+  if [[ -z "${GITHUB_TOKEN:-}" ]]; then
     read -rs -p "Enter GitHub access token: " value
     echo ""
     GITHUB_TOKEN=$value
@@ -79,22 +83,22 @@ function captureGitToken {
   fi
 }
 
-function captureK8sURL {
+capture_k8s_url() {
   url="$(oc whoami --show-server)"
   K8S_CLUSTER_URL=$url
 }
 
-function  generateK8sToken {
+generate_k8s_token() {
   sa_namespace="rhdh"
   sa_name="rhdh"
-  if [ "$use_default" == false ]; then
+  if [[ "$use_default" == false ]]; then
     read -rp "Which namespace should be used or created to check the SA holding the persistent token? (default: $sa_namespace): " selected_namespace
-    if [ -n "$selected_namespace" ]; then
+    if [[ -n "$selected_namespace" ]]; then
       sa_namespace="$selected_namespace"
     fi
 
     read -rp "What is the name of the SA? (default: $sa_name): " selected_name
-    if [ -n "$selected_name" ]; then
+    if [[ -n "$selected_name" ]]; then
       sa_name="$selected_name"
     fi
   fi
@@ -129,42 +133,44 @@ EOF
   K8S_CLUSTER_TOKEN=$(oc -n "$sa_namespace" get secret/"${sa_name}" -o jsonpath='{.data.token}' | base64 -d )
 }
 
-
-function checkPrerequisite {
+check_prerequisite() {
   if ! command -v oc &> /dev/null; then
     echo "oc is required for this script to run. Exiting."
     exit 1
   fi
 }
 
-function createBackstageSecret {
+create_backstage_secret() {
   if 2>/dev/null 1>&2 oc get secret backstage-backend-auth-secret -n "$RHDH_NAMESPACE"; then
     oc delete secret backstage-backend-auth-secret -n "$RHDH_NAMESPACE"
   fi
   declare -A secretKeys
-  if [ -n "$K8S_CLUSTER_URL" ]; then
+  if [[ -n "${K8S_CLUSTER_URL:-}" ]]; then
     secretKeys[K8S_CLUSTER_URL]=$K8S_CLUSTER_URL
   fi
-  if [ -n "$K8S_CLUSTER_TOKEN" ]; then
+  if [[ -n "${K8S_CLUSTER_TOKEN:-}" ]]; then
     secretKeys[K8S_CLUSTER_TOKEN]=$K8S_CLUSTER_TOKEN
   fi
-  if [ -n "$ARGOCD_USERNAME" ]; then
+  if [[ -n "${ARGOCD_USERNAME:-}" ]]; then
     secretKeys[ARGOCD_USERNAME]=$ARGOCD_USERNAME
   fi
-  if [ -n "$ARGOCD_URL" ]; then
+  if [[ -n "${ARGOCD_URL:-}" ]]; then
     secretKeys[ARGOCD_URL]=$ARGOCD_URL
   fi
-  if [ -n "$ARGOCD_PASSWORD" ]; then
+  if [[ -n "${ARGOCD_PASSWORD:-}" ]]; then
     secretKeys[ARGOCD_PASSWORD]=$ARGOCD_PASSWORD
   fi
-  if [ -n "$GITHUB_TOKEN" ]; then
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
     secretKeys[GITHUB_TOKEN]=$GITHUB_TOKEN
   fi
-  cmd="oc create secret generic backstage-backend-auth-secret -n $RHDH_NAMESPACE"
+  local -a cmd=(
+    oc create secret generic backstage-backend-auth-secret
+    -n "$RHDH_NAMESPACE"
+  )
   for key in "${!secretKeys[@]}"; do
-    cmd="${cmd} --from-literal=${key}=${secretKeys[$key]}"
+    cmd+=(--from-literal="${key}=${secretKeys[$key]}")
   done
-  eval "$cmd"
+  "${cmd[@]}"
 }
 
 # Function to display usage instructions
@@ -196,7 +202,7 @@ while [[ $# -gt 0 ]]; do
     shift
 done
 
-function main {
+main() {
 
   # Check if using default values or not
   if $use_default; then
@@ -205,17 +211,17 @@ function main {
       echo "Not using default values."
   fi
 
-  checkPrerequisite
-  captureK8sURL
-  generateK8sToken
-  captureRHDHNamespace
-  captureArgoCDNamespace
-  captureArgoCDURL
-  captureArgoCDCreds
-  captureGitToken
-  createBackstageSecret
+  check_prerequisite
+  capture_k8s_url
+  generate_k8s_token
+  capture_rhdh_namespace
+  capture_argocd_namespace
+  capture_argocd_url
+  capture_argocd_creds
+  capture_git_token
+  create_backstage_secret
 
   echo "Setup completed successfully!"
 }
 
-main
+main

bundle/rhdh/manifests/rhdh-plugin-deps_v1_configmap.yaml

@@ -3,7 +3,7 @@
 # Plugin Infrastructure Setup Script for RHDH with Orchestrator
 #
 
-set -e
+set -euo pipefail
 
 action="apply" # Default action
 branch="main"  # Default branch
@@ -37,7 +37,7 @@ apply_manifest() {
   local script_dir
   script_dir="$(dirname "$(realpath "$0")")"
 
-  if [ -f "${script_dir}/${file}" ]; then
+  if [[ -f "${script_dir}/${file}" ]]; then
     echo "Using local file: ${file}"
     kubectl "$action" -f "${script_dir}/${file}"
   else
@@ -47,24 +47,24 @@ apply_manifest() {
 }
 
 # Execution
-if [ "$action" == "apply" ]; then
+if [[ "$action" == "apply" ]]; then
   apply_manifest "serverless.yaml"
   echo "Waiting for CRDs to be established..."
   kubectl wait --for=condition=Established crd --all --timeout=60s
   apply_manifest "knative.yaml"
   apply_manifest "serverless-logic.yaml"
-  if [ "$cicd" == true ]; then
+  if [[ "$cicd" == true ]]; then
     echo "CICD enabled. Executing CICD-specific logic..."
     apply_manifest "argocd.yaml"
     kubectl wait --for=condition=Established crd --all --timeout=60s
     apply_manifest "argocd-cr.yaml"
     apply_manifest "pipeline.yaml"
   fi
-elif [ "$action" == "delete" ]; then
+elif [[ "$action" == "delete" ]]; then
   apply_manifest "serverless-logic.yaml"
   apply_manifest "knative.yaml"
   apply_manifest "serverless.yaml"
-  if [ "$cicd" == true ]; then
+  if [[ "$cicd" == true ]]; then
     apply_manifest "argocd.yaml"
     apply_manifest "argocd-cr.yaml"
     apply_manifest "pipeline.yaml"