feat: add recommended shell flags to executed scripts (#7)

- Recommended shell flags: `set -o errexit -o nounset -o pipefail`.

Closes #3.

Author: cgrindel

.github/workflows/ci.yaml

@@ -89,6 +89,51 @@ jobs:
           )"
           [[ "${output}" == "${expected}" ]] || \
             (echo >&2 "Ouptput from integration test does not match:" "${output}"; exit 1)
+      - name: Execute without recommended shell flags
+        uses: ./
+        with:
+          verbose: true
+          derivation-path: ./tests/integration_tests
+          shell-flags: ''
+          run: |
+            rm -f integration_test3.out
+            # This fails. If the recommended flags are set, we should not reach the following 
+            # statement.
+            ls does_not_exist
+            echo "HELLO" > integration_test3.out
+      - name: Confirm output for Execute without recommended shell flags
+        shell: bash
+        run: |
+          [[ -e integration_test3.out ]] || \
+            (echo >&2 "The integration_test3.out does not exist."; exit 1)
+          output="$(<./integration_test3.out)"
+          expected="$(cat <<-EOF
+          HELLO
+          EOF
+          )"
+          [[ "${output}" == "${expected}" ]] || \
+            (echo >&2 "Ouptput from integration test does not match:" "${output}"; exit 1)
+      - name: Execute with recommended shell flags
+        # This step should fail. We will confirm that it failed as expected in the next step.
+        continue-on-error: true 
+        uses: ./
+        with:
+          verbose: true
+          derivation-path: ./tests/integration_tests
+          run: |
+            rm -f integration_test4.out
+            # This fails. If the recommended flags are set, we should not reach the following 
+            # statement.
+            ls does_not_exist
+            echo "HELLO" > integration_test4.out
+      - name: Confirm output for Execute with recommended shell flags
+        shell: bash
+        run: |
+          if [[ -e integration_test4.out ]]; then
+            echo >&2 "The integration_test4.out exists." 
+            exit 1
+          fi
+          echo "SUCCESS"
 
   all_ci_tests:
     runs-on: ubuntu-latest

action.yaml

@@ -22,6 +22,10 @@ inputs:
     description: |
       The path to directory or the shell.nix or default.nix to use to set up the environment. This
       is the directory where nix-shell is executed.
+  shell-flags:
+    type: string
+    default: set -o errexit -o nounset -o pipefail
+    description: These flags will be set before executing the script.
   verbose:
     type: boolean
     description: Enable debug output written to stderr.
@@ -38,4 +42,7 @@ runs:
         RNS_PURE: ${{ inputs.pure }}
         RNS_DERIVATION_PATH: ${{ inputs.derivation-path }}
         RNS_VERBOSE: ${{ inputs.verbose }}
+        # If the client specifies an empty string for the flags, we need to set the RNS_SHELL_FLAGS 
+        # env variable to the special value false.
+        RNS_SHELL_FLAGS: ${{ inputs.shell-flags == '' && 'false' || inputs.shell-flags }}
       run: ${GITHUB_ACTION_PATH}/tools/run_nix_shell.sh

tests/tools_tests/BUILD.bazel

@@ -14,6 +14,8 @@ run_nix_shell_test(name = "rns_opts_test")
 
 run_nix_shell_test(name = "script_file_test")
 
+run_nix_shell_test(name = "shell_flags_test")
+
 run_nix_shell_test(name = "simple_script_test")
 
 run_nix_shell_test(name = "verbose_test")

tests/tools_tests/shell_flags_test.sh

@@ -0,0 +1,19 @@
+assert_msg="default flags will exit with an error code on failure"
+failed=false
+"${run_nix_shell_sh}" '
+[[ "true" == "false" ]]
+echo "This should not be seen."
+' > output.txt || failed=true
+output="$( <output.txt )"
+assert_equal "" "${output}" "${assert_msg}"
+assert_equal "true" "${failed}" "${assert_msg}"
+
+assert_msg="with no shell flags, script will exit without an error code on failure"
+success=false
+RNS_SHELL_FLAGS="false" "${run_nix_shell_sh}" '
+[[ "true" == "false" ]]
+echo "This should be seen."
+' > output.txt && success=true
+output="$( <output.txt )"
+assert_equal "This should be seen." "${output}" "${assert_msg}"
+assert_equal "true" "${success}" "${assert_msg}"

tools/run_nix_shell.sh

@@ -28,6 +28,8 @@ absolute_path() {
 cwd="${RNS_CWD:-}"
 script="${RNS_RUN:-}"
 derivation_path="${RNS_DERIVATION_PATH:-}"
+# The default flags listed below are equivalent to `set -euo pipefail`.
+shell_flags="${RNS_SHELL_FLAGS:-set -o errexit -o nounset -o pipefail}"
 
 pure="${RNS_PURE:-true}"
 verbose="${RNS_VERBOSE:-false}"
@@ -82,9 +84,11 @@ RNS_OPTS: ${RNS_OPTS:-}
 RNS_RUN: ${RNS_RUN:-}
 RNS_DERIVATION_PATH: ${RNS_DERIVATION_PATH:-}
 RNS_PURE: ${RNS_PURE:-}
+RNS_SHELL_FLAGS: ${RNS_SHELL_FLAGS:-}
 cwd: ${cwd:-}
 nix_shell_opts: $( printf "%q " "${nix_shell_opts[@]}" )
 pure: ${pure:-}
+shell_flags: ${shell_flags:-}
 script: ${script:-}
 derivation_path: ${derivation_path:-}
 ===
@@ -136,6 +140,12 @@ if [[ -n "${RNS_OPTS:-}" ]]; then
   fi
 fi
 
+# If the client does not want any shell flags, we use the special value "false"
+# to indicate that no flags should be applied.
+if [[ "${shell_flags:-}" == "false" ]]; then
+  shell_flags=""
+fi
+
 if [[ -z "${script:-}" ]]; then
   fail "A script or a path to a file must be provided."
 fi
@@ -148,6 +158,7 @@ if [[ -n "${cwd:-}" ]]; then
 fi
 
 script="$(cat <<-EOF
+${shell_flags:-}
 ${cd_cmd:-}
 ${script}
 EOF