AI-assisted engineering/Reviewing AI code

Fix the linter for deploy scripts

Review the AI's codeEasy10 min

Your task

An AI agent added a CI step to your deploy repo that downloads a release artifact and unpacks it, and said the script "matches the existing scripts' conventions". It did not: no strict mode, unquoted variables and no checksum. Your team now turns the house rules into a linter that runs on every script.

An assistant wrote audit_deploy_script(script_lines), the linter. It is in the editor. It has a bug. Find it and fix it.

Input and output:

script_lines: the lines of a Bash script.
Return the findings in the order below, each at most once.

Rules the tests check:

missing_strict_mode: no line is exactly set -euo pipefail once whitespace is trimmed from both ends.
download_without_fail_flag: some line contains curl but not --fail.
unquoted_expansion: some line has an expansion outside double quotes. An expansion is a dollar sign followed directly by an ASCII letter, an underscore or an opening brace. It is outside double quotes when an even number of " characters come before it on its line. A dollar sign followed by anything else, such as ( or a digit, is not an expansion. Single quotes are not tracked.
missing_integrity_check: some line contains curl, and no line contains sha256sum, gpg --verify or cosign verify.

"Contains" means the text appears anywhere in the line.

Examples

audit_deploy_script(script_lines: list[str]) -> list[str]

Example 1

Input

audit_deploy_script(["#!/bin/bash", "VERSION=$(curl -s https://api.example.com/latest | jq -r .version)", "curl -s https://cdn.example.com/app-$VERSION.tar.gz -o app.tar.gz", "tar xzf app.tar.gz -C $DEPLOY_DIR", "echo \"Deployed $VERSION\""])

Output["missing_strict_mode", "download_without_fail_flag", "unquoted_expansion", "missing_integrity_check"]

Example 2

Input

audit_deploy_script(["#!/bin/bash", "set -euo pipefail", "curl --fail --silent \"https://cdn.example.com/app-${VERSION}.tar.gz\" -o app.tar.gz", "sha256sum --check app.tar.gz.sha256", "tar xzf app.tar.gz -C \"$DEPLOY_DIR\""])

Output[]