Skip to content

feat: Add update script for custom config #2585

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: Add update script for custom config #2585

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions config/update-ciso-assistant.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
#! /usr/bin/env bash
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Correct the shebang.

There must be no space after #!.

Apply:

-#! /usr/bin/env bash
+#!/usr/bin/env bash

Also ensure the script is executable: git update-index --chmod=+x config/update-ciso-assistant.sh

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
#! /usr/bin/env bash
#!/usr/bin/env bash
🧰 Tools
🪛 Shellcheck (0.11.0)

[error] 1-1: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

🤖 Prompt for AI Agents 
In config/update-ciso-assistant.sh around line 1 the shebang has an extra space
("#! /usr/bin/env bash"); remove the space so it reads "#!/usr/bin/env bash" and
save the file, then mark the script as executable in git with: git update-index
--chmod=+x config/update-ciso-assistant.sh.

set -euo pipefail

DB_FILE="db/ciso-assistant.sqlite3"
BACKUP_FILE="ciso-assistant-backup.sqlite3"
Comment on lines +4 to +5
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Harden backup handling: location, timestamp, and permissions.

Current backup goes to CWD with default perms, which can expose sensitive data.

Apply:

-DB_FILE="db/ciso-assistant.sqlite3"
-BACKUP_FILE="ciso-assistant-backup.sqlite3"
+DB_FILE="db/ciso-assistant.sqlite3"
+# Timestamped backup placed alongside the DB
+BACKUP_FILE="db/ciso-assistant-backup-$(date -u +%Y%m%d%H%M%S).sqlite3"

And ensure restrictive perms:

-  cp "$DB_FILE" "$BACKUP_FILE"
+  umask 077
+  cp "$DB_FILE" "$BACKUP_FILE"

Optional: use sqlite3 online backup if you ever decide to back up while services run:

  • sqlite3 "$DB_FILE" ".backup '$BACKUP_FILE'"

Also applies to: 12-13

🧰 Tools
🪛 Shellcheck (0.11.0)

[error] 4-4: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 5-5: Literal carriage return. Run script through tr -d '\r' .

(SC1017)


# Backup the database
if [ ! -f "$DB_FILE" ]; then
echo "Error: No database found, please initialize CISO Assistant first"
exit 1
else
cp "$DB_FILE" "$BACKUP_FILE"
echo "Backup of the database created in $BACKUP_FILE"
fi
Comment on lines +7 to +14
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Stop services before backing up the SQLite DB (avoid corrupted backups).

Copying a live SQLite file risks corruption. Stop containers first, then back up.

Apply:

-# Backup the database
-if [ ! -f "$DB_FILE" ]; then
-  echo "Error: No database found, please initialize CISO Assistant first"
-  exit 1
-else
-  cp "$DB_FILE" "$BACKUP_FILE"
-  echo "Backup of the database created in $BACKUP_FILE"
-fi
-
-# Stop and clean the containers for custom config
-docker compose -f docker-compose-custom.yml rm -fs
+# Stop and clean the containers for custom config
+docker compose -f docker-compose-custom.yml rm -fs
+
+# Backup the database (after containers are stopped)
+if [ ! -f "$DB_FILE" ]; then
+  echo "Error: No database found, please initialize CISO Assistant first"
+  exit 1
+else
+  cp "$DB_FILE" "$BACKUP_FILE"
+  echo "Backup of the database created in $BACKUP_FILE"
+fi

Also applies to: 16-18

🧰 Tools
🪛 Shellcheck (0.11.0)

[error] 7-7: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 8-8: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 9-9: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 10-10: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 11-11: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 12-12: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 13-13: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 14-14: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

🤖 Prompt for AI Agents 
In config/update-ciso-assistant.sh around lines 7 to 14 (and also apply same fix
to lines 16-18), the script copies the SQLite DB while services may still be
running which can produce corrupted backups; modify the script to stop the
service(s) or container(s) that access the DB before creating the backup, verify
they stopped successfully, perform the cp to create the backup, and then restart
the service(s)/container(s) after the backup completes (ensure to handle and
fail with an error if stop or restart commands fail).


# Stop and clean the containers for custom config
docker compose -f docker-compose-custom.yml rm -fs

# note: the rmi trick is not needed anymore since we move to always pull policy
# Start the containers for custom config
docker compose -f docker-compose-custom.yml up -d
Comment on lines +1 to +21
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Fix CRLF line endings (prevents /usr/bin/env bash^M errors).

The file is committed with Windows CRLF endings. On Linux/macOS this will fail to execute.

Recommended remediation:

  • Convert this file to LF once: dos2unix config/update-ciso-assistant.sh (or git config core.autocrlf false and re-add)
  • Enforce via .gitattributes:
+*.sh text eol=lf

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Shellcheck (0.11.0)

[error] 1-1: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 2-2: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 3-3: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 4-4: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 5-5: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 6-6: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 7-7: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 8-8: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 9-9: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 10-10: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 11-11: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 12-12: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 13-13: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 14-14: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 15-15: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 16-16: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 17-17: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 18-18: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 19-19: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 20-20: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

[error] 21-21: Literal carriage return. Run script through tr -d '\r' .

(SC1017)

🤖 Prompt for AI Agents 
In config/update-ciso-assistant.sh lines 1-21 the script is committed with CRLF
endings which cause “/usr/bin/env bash^M” execution errors on Unix; convert the
file to LF (e.g., run dos2unix config/update-ciso-assistant.sh or set git config
core.autocrlf false, re-add the file), ensure the executable bit is preserved,
add a .gitattributes entry like "*.sh text eol=lf" to enforce LF on commit, and
commit the normalized file so CI and Unix systems run the script correctly.

echo "CISO assistant updated successfully"