bash-pro

Bash Pro - Defensive Script Programming and Production-Grade Automation

Skill Overview

Bash Pro focuses on writing secure, reliable, and portable production-grade Bash scripts, covering CI/CD automation, system tools, and defensive programming best practices.

Applicable Scenarios

CI/CD Pipeline Script Development

Write reliable deployment and automation scripts for CI/CD platforms like GitHub Actions and GitLab CI, ensuring build processes are stable and reproducible.

Automated Operations and System Administration

Create automation scripts for routine system maintenance tasks, including log processing, file management, and service monitoring, with emphasis on error handling and security hardening.

Script Security Review and Hardening

Perform security reviews of existing shell scripts, use ShellCheck static analysis to identify potential vulnerabilities, and add input validation and protective measures.

Core Features

Defensive Programming and Error Handling

Apply the strict mode set -Eeuo pipefail, protect variable expansions, handle signals with trap, and perform comprehensive input validation to ensure scripts exit safely under exceptional conditions.

Cross-Platform Portability Assurance

Handle differences between Linux and macOS tools (e.g., sed -i), detect Bash version compatibility, provide POSIX fallback implementations, and include platform-specific conditional branches.

Comprehensive Testing and Quality Assurance

Write unit tests with Bats or shellspec, integrate ShellCheck and shfmt into the development workflow, and configure pre-commit hooks and CI checks.

Frequently Asked Questions

When should I use Bash instead of Python?

Bash is suitable for invoking system commands, handling files and processes, and writing simple automation tasks. If the work involves complex logic, data structures, or cross-platform GUIs, Python is a better choice. Bash Pro also clearly notes it is not suitable for cases that require pure POSIX sh or Windows PowerShell.

How do I avoid common security vulnerabilities in Bash scripts?

Always quote variable expansions $var as "$var", avoid using eval on user input, use [[ ]] for conditionals, create temporary files safely with mktemp, and whitelist-validate inputs. ShellCheck can automatically detect many of these issues.

Why is set -e not enough?

set -e behaves inconsistently in pipelines, subshells, and function calls. Bash Pro recommends using set -Eeuo pipefail together with shopt -s inherit_errexit, and explicitly capturing errors with trap to ensure all exceptions are handled correctly.