jenkins: validate setup.sh inputs, pipefail in cgSign/Verify, lockfile cleanup

Five Copilot findings from the eleventh pass on PR #330:

- setup.sh: trim + validate user-supplied CHAINGUARD_ORG and
  PUSH_REGISTRY (sanitize_env_value + validate_env_value helpers)
  before persisting. Rejects empty, internal whitespace, and quotes —
  all of which would silently break .env parsing by docker compose /
  JCasC / bash `source`. Also re-validates values inherited from .env
  so a hand-edited corruption surfaces at setup.sh entry rather than
  mid-`terraform apply`.
- cgSign + cgVerify: switch the digest-resolution sh blocks from
  `set -eu` to `set -eu -o pipefail` so a failing `docker image
  inspect` mid-pipeline surfaces as the script's exit status rather
  than being masked by the trailing `head -1` returning 0.
- teardown.sh: also remove iac/.terraform.lock.hcl and
  harbor/terraform/.terraform.lock.hcl on cleanup. They're generated
  by terraform init and gitignored, so a "full teardown" leaving them
  behind contradicts the script's stated goal. (Preserved alongside
  iac/terraform.tfstate when TF_DESTROY_FAILED so the user can retry.)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ericsmalling

jenkins/setup.sh

@@ -41,16 +41,53 @@ prompt_yn() {
   [[ "$ans" =~ ^[Yy] ]]
 }
 
+# Strip leading/trailing whitespace from $1 and echo the result.
+sanitize_env_value() {
+  local v="$1"
+  v="${v#"${v%%[![:space:]]*}"}"
+  v="${v%"${v##*[![:space:]]}"}"
+  printf '%s' "$v"
+}
+
+# Validate a value about to be written to .env. Rejects empty, internal
+# whitespace, and quotes — all of which would either silently corrupt the
+# dotenv line (parsed by docker compose / JCasC / bash `source`) or be
+# easy footguns from a stray paste.
+validate_env_value() {
+  local name="$1" v="$2"
+  if [[ -z "$v" ]]; then
+    echo "    ERROR: $name must not be empty." >&2
+    return 1
+  fi
+  if [[ "$v" =~ [[:space:]] ]]; then
+    echo "    ERROR: $name must not contain whitespace (got: '$v')." >&2
+    return 1
+  fi
+  if [[ "$v" == *\"* || "$v" == *\'* ]]; then
+    echo "    ERROR: $name must not contain quotes (got: '$v')." >&2
+    return 1
+  fi
+  return 0
+}
+
 # Prompt for the Chainguard org if .env didn't supply one. The answer gets
 # persisted to .env in Phase 1 below, so subsequent re-runs go straight
 # through without prompting.
 if [[ -z "${CHAINGUARD_ORG:-}" ]]; then
   echo "==> No Chainguard org configured."
   echo "    Examples: 'chainguard' (public catalog) or 'your-org.example.com'."
-  while [[ -z "${CHAINGUARD_ORG:-}" ]]; do
+  while :; do
     read -rp "    Enter your Chainguard org: " CHAINGUARD_ORG
+    CHAINGUARD_ORG=$(sanitize_env_value "$CHAINGUARD_ORG")
+    if validate_env_value CHAINGUARD_ORG "$CHAINGUARD_ORG"; then break; fi
   done
   echo
+else
+  # Even values supplied via env / .env can have stray whitespace from a
+  # hand-edited dotenv — re-validate so the corruption surfaces here rather
+  # than mid-`terraform apply`.
+  CHAINGUARD_ORG=$(sanitize_env_value "$CHAINGUARD_ORG")
+  validate_env_value CHAINGUARD_ORG "$CHAINGUARD_ORG" || exit 1
 fi
 ORG="$CHAINGUARD_ORG"
 echo "==> Chainguard org: ${ORG}"
@@ -76,13 +113,15 @@ if [[ "$PUSH_TO_HARBOR" == "true" ]]; then
 else
   PUSH_REGISTRY_DEFAULT="${PUSH_REGISTRY:-}"
   PUSH_REGISTRY=""
-  while [[ -z "$PUSH_REGISTRY" ]]; do
+  while :; do
     if [[ -n "$PUSH_REGISTRY_DEFAULT" ]]; then
       read -rp "Where should pipelines push their built images? [last used: ${PUSH_REGISTRY_DEFAULT}]: " PUSH_REG_INPUT
       PUSH_REGISTRY="${PUSH_REG_INPUT:-$PUSH_REGISTRY_DEFAULT}"
     else
       read -rp "Where should pipelines push their built images? (e.g. ttl.sh/your-prefix): " PUSH_REGISTRY
     fi
+    PUSH_REGISTRY=$(sanitize_env_value "$PUSH_REGISTRY")
+    if validate_env_value PUSH_REGISTRY "$PUSH_REGISTRY"; then break; fi
   done
 fi
 

jenkins/shared-libraries/cg-images/vars/cgSign.groovy

@@ -57,7 +57,10 @@ def call(String image) {
       string(credentialsId: 'cosign-password',  variable: 'COSIGN_PASSWORD'),
     ]) {
       sh '''
-        set -eu
+        set -eu -o pipefail
+        # pipefail so a failing `docker image inspect` (e.g. image not in
+        # the local cache yet) is surfaced as the pipeline's exit status
+        # rather than masked by the trailing `head -1` returning 0.
         # Pick the RepoDigest whose repo matches the image we just pushed.
         # The local image cache may have stale RepoDigests from prior runs
         # under different registries (e.g. localhost/library from a Mode C

jenkins/shared-libraries/cg-images/vars/cgVerify.groovy

@@ -36,7 +36,10 @@ def call(String image) {
       file(credentialsId: 'cosign-public-key', variable: 'COSIGN_PUB_FILE'),
     ]) {
       sh '''
-        set -eu
+        set -eu -o pipefail
+        # pipefail so a failing `docker image inspect` (e.g. image not in
+        # the local cache yet) is surfaced as the pipeline's exit status
+        # rather than masked by the trailing `head -1` returning 0.
         # Pick the RepoDigest whose repo matches the image we want to verify.
         # See cgSign.groovy for why .RepoDigests can have stale entries from
         # prior runs.

jenkins/teardown.sh

@@ -98,11 +98,11 @@ rm -f  shared-libraries/cg-images/IDENTITY
 # kind cluster gets blown away wholesale by harbor/teardown.sh), so we
 # clean it unconditionally.
 if (( TF_DESTROY_FAILED == 0 )); then
-  rm -rf iac/.terraform iac/terraform.tfstate iac/terraform.tfstate.backup iac/jenkins-jwks.json
+  rm -rf iac/.terraform iac/.terraform.lock.hcl iac/terraform.tfstate iac/terraform.tfstate.backup iac/jenkins-jwks.json
 else
-  echo "    Preserving iac/terraform.tfstate so a future ./teardown.sh can retry the destroy."
+  echo "    Preserving iac/terraform.tfstate (and .terraform.lock.hcl) so a future ./teardown.sh can retry the destroy."
 fi
-rm -rf harbor/terraform/.terraform harbor/terraform/terraform.tfstate harbor/terraform/terraform.tfstate.backup harbor/terraform/terraform.tfvars
+rm -rf harbor/terraform/.terraform harbor/terraform/.terraform.lock.hcl harbor/terraform/terraform.tfstate harbor/terraform/terraform.tfstate.backup harbor/terraform/terraform.tfvars
 rm -f  harbor/cg/helm/values.yaml harbor/cg/manifests/deploy-ingress-nginx.yaml
 
 if [[ "$WIPE_ENV" == "true" ]]; then