Write Robust and Secure Bash Scripts

This skill writes and reviews production-grade Bash scripts for automation, CI/CD, and ops, with a strong emphasis on defensive programming, portability, and hardening. Its core approach is strict mode (set -Eeuo pipefail plus shopt -s inherit_errexit on Bash 4.4+) with all variable expansions quoted, arrays and proper iteration instead of unsafe patterns like for f in $(ls), getopts-based argument parsing with usage functions, mktemp plus trap for safe temporary resource cleanup, printf over echo, $() over backticks, structured timestamped logging with configurable verbosity, idempotent/dry-run-capable design, IFS=$'\n\t' to prevent unwanted word splitting, required-variable validation via : "${VAR:?message}", -- to end option parsing before destructive operations like rm -rf -- "$dir", and NUL-safe patterns (find -print0 | while IFS= read -r -d '' file) for filenames with special characters. Portability guidance covers the #!/usr/bin/env bash shebang, runtime Bash-version checks (BASH_VERSINFO), verifying required external commands exist, detecting GNU-vs-BSD tool differences (e.g. sed -i syntax), and documenting minimum version requirements. Readability conventions specify snake_case functions/variables, UPPER_CASE constants, functions under 50 lines, and long-form options (--verbose) for clarity. Safety and security patterns include readonly constants, local for all function variables, timeout on external commands to prevent hangs, never using eval on user input, numeric input validation via regex, restrictive umask for sensitive file operations, and trap for cleanup on any exit path. Performance guidance favors Bash built-ins ([[ ]], ${var//pattern/replacement}) over external processes, mapfile/readarray for array population, arithmetic expansion over expr, and xargs -P for parallelizable work. Documentation standards call for --help/--version flags, documented exit codes, and generated docs/man pages via shdoc/shellman. Modern Bash 5.x features are catalogued version-by-version (5.0's ${var@U}/${var@L} case conversion, 5.1's compat shopt options, 5.2's varredir_close and EPOCHREALTIME), alongside 4.4+ parameter-transformation operators (@Q shell-quoted, @E escape-expanded, @P prompt-expanded, @A assignment format). CI/CD integration covers ShellCheck problem-matcher annotations in GitHub Actions, pre-commit hooks (shellcheck/shfmt/checkbashisms), matrix testing across Bash 4.4-5.2 on Linux/macOS, and official bash:5.2 container images for reproducible tests. Security hardening covers SAST via Semgrep, secrets detection via gitleaks/trufflehog, checksum verification for sourced scripts, and container sandboxing for untrusted script execution. Observability guidance covers structured JSON logging, DEBUG/INFO/WARN/ERROR levels, logger for syslog integration, trace IDs for multi-script correlation, and Prometheus-format metrics export. A quality checklist and output list define what "done" looks like: ShellCheck-clean, shfmt-formatted, Bats-tested with edge cases, fully quoted, all failure modes handled, and portable across target platforms - Dependency management practices include lock files pinning exact versions and automated update tooling like Dependabot or Renovate, alongside essential tooling (ShellCheck, shfmt, checkbashisms, bats-core, shellspec, bashly, basher/bpkg) and a list of common pitfalls (unquoted expansions, set -e without proper trapping, missing cleanup traps, unsafe array population).

Use this skill when writing or reviewing Bash scripts for automation, CI/CD, or ops, or hardening existing shell scripts for safety and portability. Do not use it when the target requires POSIX-only shell without Bash-specific features, when the task's logic is complex enough to warrant a higher-level language instead, or when Windows-native scripting (PowerShell) is what's actually needed.

Input is a script's intended inputs, outputs, and failure modes, or an existing Bash script needing hardening. Output is a production-ready Bash script with strict mode, safe argument parsing, structured logging, and test coverage (Bats), plus supporting artifacts like CI/CD pipeline configs, static-analysis config files, and generated documentation.

Built around ShellCheck and shfmt for static analysis and formatting, bats-core/shellspec/shunit2 for testing, gitleaks/Semgrep/CodeQL for security scanning, and CI/CD platforms (GitHub Actions, GitLab CI) with matrix testing across Bash 4.4-5.2 on Linux and macOS.

set -Eeuo pipefail
shopt -s inherit_errexit

Engineers writing or hardening production Bash scripts for automation, CI/CD, or operations who need defensive, portable, security-reviewed, and thoroughly tested shell code rather than ad hoc scripting.