Clean up scripts

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ on:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}

.github/workflows/release.yml

@@ -10,7 +10,7 @@ on:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
 
 jobs:
   create-release:

.markdownlint-cli2.yaml

@@ -1,9 +1,10 @@
-# https://github.com/DavidAnson/markdownlint#rules--aliases
+# https://github.com/DavidAnson/markdownlint/blob/HEAD/doc/Rules.md
 config:
-  line-length: false
-  no-duplicate-heading: false
-  no-inline-html: false
-  no-emphasis-as-heading: false
+  line-length: false # MD013
+  no-duplicate-heading: false # MD024
+  no-blanks-blockquote: false # MD028
+  no-inline-html: false # MD033
+  no-emphasis-as-heading: false # MD036
 
 # https://github.com/DavidAnson/markdownlint-cli2#markdownlint-cli2jsonc
 noBanner: true

.shellcheckrc

@@ -2,13 +2,34 @@
 # https://github.com/koalaman/shellcheck/blob/HEAD/shellcheck.1.md#rc-files
 
 # See also:
-# https://www.shellcheck.net/wiki/Optional
+# https://github.com/koalaman/shellcheck/wiki/Optional
 # https://google.github.io/styleguide/shellguide.html
 
-# https://www.shellcheck.net/wiki/SC2292
+# https://github.com/koalaman/shellcheck/wiki/SC2249
+# enable=add-default-case
+
+# https://github.com/koalaman/shellcheck/wiki/SC2244
+enable=avoid-nullary-conditions
+
+# https://github.com/koalaman/shellcheck/wiki/SC2312
+# enable=check-extra-masked-returns
+
+# https://github.com/koalaman/shellcheck/wiki/SC2310
+# https://github.com/koalaman/shellcheck/wiki/SC2311
+# enable=check-set-e-suppressed
+
+# enable=check-unassigned-uppercase
+
+# https://github.com/koalaman/shellcheck/wiki/SC2230
+enable=deprecate-which
+
+# https://github.com/koalaman/shellcheck/wiki/SC2248
+enable=quote-safe-variables
+
+# https://github.com/koalaman/shellcheck/wiki/SC2292
 # https://google.github.io/styleguide/shellguide.html#s6.3-tests
 enable=require-double-brackets
 
-# https://www.shellcheck.net/wiki/SC2250
+# https://github.com/koalaman/shellcheck/wiki/SC2250
 # https://google.github.io/styleguide/shellguide.html#s5.6-variable-expansion
 enable=require-variable-braces

main.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: Apache-2.0 OR MIT
-set -eEuo pipefail
+set -CeEuo pipefail
 IFS=$'\n\t'
 
 retry() {
@@ -14,24 +14,24 @@ retry() {
     "$@"
 }
 bail() {
-    echo "::error::$*"
+    printf '::error::%s\n' "$*"
     exit 1
 }
 warn() {
-    echo "::warning::$*"
+    printf '::warning::%s\n' "$*"
 }
 download_and_checksum() {
     local url="${1:?}"
     local checksum="${2:?}"
     retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 "${url}" -o tmp
-    if type -P sha256sum &>/dev/null; then
+    if type -P sha256sum >/dev/null; then
         sha256sum -c - >/dev/null <<<"${checksum} *tmp"
-    elif type -P shasum &>/dev/null; then
+    elif type -P shasum >/dev/null; then
         # GitHub-hosted macOS runner does not install GNU Coreutils by default.
         # https://github.com/actions/runner-images/issues/90
         shasum -a 256 -c - >/dev/null <<<"${checksum} *tmp"
     else
-        warn "checksum requires 'sha256sum' or 'shasum' command; consider installing one of them; skipped checksum for $(basename "${url}")"
+        warn "checksum requires 'sha256sum' or 'shasum' command; consider installing one of them; skipped checksum for $(basename -- "${url}")"
     fi
 }
 
@@ -77,7 +77,7 @@ fi
 version="${tag}"
 # extract the portion of the tag matching the prefix pattern
 if [[ -n "${prefix}" ]]; then
-    prefix=$(grep <<<"${tag}" -Eo "^${prefix}")
+    prefix=$(grep -Eo "^${prefix}" <<<"${tag}")
     prefix="${prefix%-}"
     version="${tag#"${prefix}"}"
     version="${version#-}"
@@ -110,6 +110,7 @@ if [[ -n "${branch}" ]]; then
     fi
 fi
 
+notes=''
 if [[ -n "${changelog}" ]]; then
     # https://github.com/taiki-e/install-action/blob/HEAD/manifests/parse-changelog.json
     parse_changelog_version='0.6.10'
@@ -140,22 +141,22 @@ if [[ -n "${changelog}" ]]; then
         *) bail "unrecognized OS type '$(uname -s)'" ;;
     esac
     action_dir="${HOME}/.create-gh-release-action"
-    mkdir -p "${action_dir}/bin"
+    mkdir -p -- "${action_dir}/bin"
     (
-        cd "${action_dir}/bin"
+        cd -- "${action_dir}/bin"
         download_and_checksum "https://github.com/taiki-e/parse-changelog/releases/download/v${parse_changelog_version}/parse-changelog-${parse_changelog_target}.tar.gz" "${parse_changelog_checksum}"
         tar xzf tmp
     )
     parse_changelog_options+=("${changelog}" "${version}")
 
     # If allow_missing_changelog is true then default to empty value if version not found
     if [[ "${allow_missing_changelog}" == "true" ]]; then
-        notes=$("${action_dir}/bin/parse-changelog${exe}" "${parse_changelog_options[@]}" || echo "")
+        notes=$("${action_dir}/bin/parse-changelog${exe}" "${parse_changelog_options[@]}" || true)
     else
         notes=$("${action_dir}/bin/parse-changelog${exe}" "${parse_changelog_options[@]}")
     fi
 
-    rm -rf "${action_dir}"
+    rm -rf -- "${action_dir}"
 fi
 
 # https://cli.github.com/manual/gh_release_view
@@ -165,16 +166,16 @@ if GITHUB_TOKEN="${token}" gh release view "${tag}" &>/dev/null; then
 fi
 
 # https://cli.github.com/manual/gh_release_create
-GITHUB_TOKEN="${token}" retry gh release create "${release_options[@]}" --title "${title}" --notes "${notes:-}"
+GITHUB_TOKEN="${token}" retry gh release create "${release_options[@]}" --title "${title}" --notes "${notes}"
 
 # Set (computed) prefix and version outputs for future step use.
 computed_prefix=${tag%"${version}"}
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-    echo "computed-prefix=${computed_prefix}" >>"${GITHUB_OUTPUT}"
-    echo "version=${version}" >>"${GITHUB_OUTPUT}"
+    printf 'computed-prefix=%s\n' "${computed_prefix}" >>"${GITHUB_OUTPUT}"
+    printf 'version=%s\n' "${version}" >>"${GITHUB_OUTPUT}"
 else
     # Self-hosted runner may not set GITHUB_OUTPUT.
     warn "GITHUB_OUTPUT is not set; skip setting 'computed-prefix' and 'version' outputs"
-    echo "computed-prefix: ${computed_prefix}"
-    echo "version: ${version}"
+    printf 'computed-prefix: %s\n' "${computed_prefix}"
+    printf 'version: %s\n' "${version}"
 fi

tools/publish.sh

@@ -1,11 +1,9 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: Apache-2.0 OR MIT
-set -eEuo pipefail
+set -CeEuo pipefail
 IFS=$'\n\t'
-cd "$(dirname "$0")"/..
-
-# shellcheck disable=SC2154
-trap 's=$?; echo >&2 "$0: error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}' ERR
+trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
+cd -- "$(dirname -- "$0")"/..
 
 # Publish a new release.
 #
@@ -26,7 +24,7 @@ retry() {
     "$@"
 }
 bail() {
-    echo >&2 "error: $*"
+    printf >&2 'error: %s\n' "$*"
     exit 1
 }
 
@@ -41,6 +39,11 @@ fi
 if [[ $# -gt 1 ]]; then
     bail "invalid argument '$2'"
 fi
+if { sed --help 2>&1 || true; } | grep -Eq -e '-i extension'; then
+    in_place=(-i '')
+else
+    in_place=(-i)
+fi
 
 # Make sure there is no uncommitted change.
 git diff --exit-code
@@ -52,12 +55,15 @@ if gh release view "${tag}" &>/dev/null; then
 fi
 
 # Make sure that the release was created from an allowed branch.
-if ! git branch | grep -q '\* main$'; then
+if ! git branch | grep -Eq '\* main$'; then
     bail "current branch is not 'main'"
 fi
+if ! git remote -v | grep -F origin | grep -Eq 'github\.com[:/]taiki-e/'; then
+    bail "cannot publish a new release from fork repository"
+fi
 
 release_date=$(date -u '+%Y-%m-%d')
-tags=$(git --no-pager tag | (grep -E "^${tag_prefix}[0-9]+" || true))
+tags=$(git --no-pager tag | { grep -E "^${tag_prefix}[0-9]+" || true; })
 if [[ -n "${tags}" ]]; then
     # Make sure the same release does not exist in changelog.
     if grep -Eq "^## \\[${version//./\\.}\\]" "${changelog}"; then
@@ -67,11 +73,12 @@ if [[ -n "${tags}" ]]; then
         bail "link to ${version} already exist in ${changelog}"
     fi
     # Update changelog.
-    remote_url=$(grep -E '^\[Unreleased\]: https://' "${changelog}" | sed 's/^\[Unreleased\]: //; s/\.\.\.HEAD$//')
+    remote_url=$(grep -E '^\[Unreleased\]: https://' "${changelog}" | sed -E 's/^\[Unreleased\]: //; s/\.\.\.HEAD$//')
     prev_tag="${remote_url#*/compare/}"
     remote_url="${remote_url%/compare/*}"
-    sed -i "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n## [${version}] - ${release_date}/" "${changelog}"
-    sed -i "s#^\[Unreleased\]: https://.*#[Unreleased]: ${remote_url}/compare/${tag}...HEAD\\n[${version}]: ${remote_url}/compare/${prev_tag}...${tag}#" "${changelog}"
+    sed -E "${in_place[@]}" \
+        -e "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n## [${version}] - ${release_date}/" \
+        -e "s#^\[Unreleased\]: https://.*#[Unreleased]: ${remote_url}/compare/${tag}...HEAD\\n[${version}]: ${remote_url}/compare/${prev_tag}...${tag}#" "${changelog}"
     if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" "${changelog}"; then
         bail "failed to update ${changelog}"
     fi
@@ -94,9 +101,9 @@ changes=$(parse-changelog "${changelog}" "${version}")
 if [[ -z "${changes}" ]]; then
     bail "changelog for ${version} has no body"
 fi
-echo "============== CHANGELOG =============="
-echo "${changes}"
-echo "======================================="
+printf '============== CHANGELOG ==============\n'
+printf '%s\n' "${changes}"
+printf '=======================================\n'
 
 if [[ -n "${tags}" ]]; then
     # Create a release commit.