Improve shell script safety and error handling

cron/backup_artificial.sh

@@ -1,36 +1,41 @@
 #!/bin/bash
-if [ ! -z "${NOBACKUP}" ]
+# Safer backup of artificial (very large IDs) rows for a specific DB.
+# Behavior preserved; improved quoting and error handling.
+set -euo pipefail
+
+if [ ! -z "${NOBACKUP:-}" ]
 then
   exit 0
 fi
-if [ -z "$1" ]
+if [ -z "${1:-}" ]
 then
   echo "$0: you need to provide database name as an argument"
   exit 1
 fi
-db=$1
+db="$1"
 if [ "$db" = "devstats" ]
 then
   exit 0
 fi
 cd /tmp || exit 1
 function finish {
-  cd /tmp
-  rm $db.*
+  cd /tmp || true
+  rm -f -- "$db".* || true
 }
 trap finish EXIT
-db.sh psql $db -tAc "\copy (select * from gha_events where id > 281474976710656) TO '/tmp/$db.events.tsv'" || exit 2
-db.sh psql $db -tAc "\copy (select * from gha_payloads where event_id > 281474976710656) TO '/tmp/$db.payloads.tsv'" || exit 3
-db.sh psql $db -tAc "\copy (select * from gha_issues where event_id > 281474976710656) TO '/tmp/$db.issues.tsv'" || exit 4
-db.sh psql $db -tAc "\copy (select * from gha_pull_requests where event_id > 281474976710656) TO '/tmp/$db.prs.tsv'" || exit 5
-db.sh psql $db -tAc "\copy (select * from gha_milestones where event_id > 281474976710656) TO '/tmp/$db.milestones.tsv'" || exit 6
-db.sh psql $db -tAc "\copy (select * from gha_issues_labels where event_id > 281474976710656) TO '/tmp/$db.labels.tsv'" || exit 7
-db.sh psql $db -tAc "\copy (select * from gha_issues_assignees where event_id > 281474976710656) TO '/tmp/$db.issue_assignees.tsv'" || exit 8
-db.sh psql $db -tAc "\copy (select * from gha_pull_requests_assignees where event_id > 281474976710656) TO '/tmp/$db.pr_assignees.tsv'" || exit 9
-db.sh psql $db -tAc "\copy (select * from gha_pull_requests_requested_reviewers where event_id > 281474976710656) TO '/tmp/$db.pr_reviewers.tsv'" || exit 10
-db.sh psql $db -tAc "\copy (select * from gha_issues_events_labels where event_id > 281474976710656) TO '/tmp/$db.issues_events_labels.tsv'" || exit 11
-db.sh psql $db -tAc "\copy (select * from gha_texts where event_id > 281474976710656) TO '/tmp/$db.texts.tsv'" || exit 12
-rm -f $db.tar* || exit 13
-tar cf $db.tar $db.*.tsv || exit 14
-xz $db.tar || exit 15
-mv $db.tar.xz /var/www/html/ || exit 16
+
+db.sh psql "$db" -tAc "\\copy (select * from gha_events where id > 281474976710656) TO '/tmp/$db.events.tsv'" || exit 2
+db.sh psql "$db" -tAc "\\copy (select * from gha_payloads where event_id > 281474976710656) TO '/tmp/$db.payloads.tsv'" || exit 3
+db.sh psql "$db" -tAc "\\copy (select * from gha_issues where event_id > 281474976710656) TO '/tmp/$db.issues.tsv'" || exit 4
+db.sh psql "$db" -tAc "\\copy (select * from gha_pull_requests where event_id > 281474976710656) TO '/tmp/$db.prs.tsv'" || exit 5
+db.sh psql "$db" -tAc "\\copy (select * from gha_milestones where event_id > 281474976710656) TO '/tmp/$db.milestones.tsv'" || exit 6
+db.sh psql "$db" -tAc "\\copy (select * from gha_issues_labels where event_id > 281474976710656) TO '/tmp/$db.labels.tsv'" || exit 7
+db.sh psql "$db" -tAc "\\copy (select * from gha_issues_assignees where event_id > 281474976710656) TO '/tmp/$db.issue_assignees.tsv'" || exit 8
+db.sh psql "$db" -tAc "\\copy (select * from gha_pull_requests_assignees where event_id > 281474976710656) TO '/tmp/$db.pr_assignees.tsv'" || exit 9
+db.sh psql "$db" -tAc "\\copy (select * from gha_pull_requests_requested_reviewers where event_id > 281474976710656) TO '/tmp/$db.pr_reviewers.tsv'" || exit 10
+db.sh psql "$db" -tAc "\\copy (select * from gha_issues_events_labels where event_id > 281474976710656) TO '/tmp/$db.issues_events_labels.tsv'" || exit 11
+db.sh psql "$db" -tAc "\\copy (select * from gha_texts where event_id > 281474976710656) TO '/tmp/$db.texts.tsv'" || exit 12
+rm -f -- "$db".tar* || exit 13
+tar cf "$db".tar "$db".*.tsv || exit 14
+xz "$db".tar || exit 15
+mv "$db".tar.xz /var/www/html/ || exit 16

grafana/shared/grafana_start.sh

@@ -163,7 +163,7 @@ then
     fi
     if [ -d "$f" ]
     then
-      rm -f $f/*
+      rm -f -- "$f"/*
     fi
   done
   for f in /grafana/dashboards/*
@@ -173,7 +173,7 @@ then
       echo "Skipping $f"
       continue
     fi
-    rm -rf $f
+    rm -rf -- "$f"
   done
 fi
 

util_sh/db_data_mv.sh

@@ -1,7 +1,46 @@
 #!/bin/bash
-cp -Rv $1 /storage/psql/$1
-rm -rf $1
-ln -s /storage/psql/$1 $1
-chown -R postgres /storage/psql/$1
-chgrp -R postgres /storage/psql/$1
-chmod -R go+rx /storage/psql/$1
+# Safely move a PostgreSQL data directory to /storage/psql and replace it with a symlink.
+# Improvements:
+# - Strict mode and validation to prevent accidental deletions when $1 is empty or invalid
+# - Quote all paths and guard rm with '--'
+# - Create destination parent directory when needed
+set -euo pipefail
+
+if [ $# -ne 1 ]; then
+  echo "Usage: $0 <data_dir_name_or_path>" >&2
+  exit 1
+fi
+
+src="$1"
+# Ensure source exists and is a directory
+if [ -z "$src" ] || [ ! -d "$src" ]; then
+  echo "$0: source directory '$src' does not exist or is not a directory" >&2
+  exit 2
+fi
+
+# Compute destination path; preserve provided relative/absolute subpath under /storage/psql
+# Example: src='pgdata'  -> dest='/storage/psql/pgdata'
+#          src='var/lib/pg' -> dest='/storage/psql/var/lib/pg'
+dest="/storage/psql/$src"
+
+# Create destination parent directories if missing
+parent_dir="$(dirname "$dest")"
+mkdir -p "$parent_dir"
+
+# Do not overwrite an existing destination unintentionally
+if [ -e "$dest" ]; then
+  echo "$0: destination '$dest' already exists; aborting to avoid data loss" >&2
+  exit 3
+fi
+
+# Copy data recursively, preserving attributes
+cp -a -v -- "$src" "$dest"
+
+# Remove original directory and create symlink pointing to the new location
+rm -rf -- "$src"
+ln -s "$dest" "$src"
+
+# Adjust ownership/permissions on the destination tree
+chown -R postgres "$dest"
+chgrp -R postgres "$dest"
+chmod -R go+rx "$dest"

util_sh/sort_json.sh

@@ -1,8 +1,11 @@
 #!/bin/bash
-if [ -z "$1" ]
+set -euo pipefail
+if [ -z "${1:-}" ]
 then
   echo "$0: please provide a file name as a 1st arg"
   exit 1
 fi
-out=`mktemp XXXXXX`
-cat "$1" | jq '.' -S > $out && mv $out "$1"
+# Create temp file in current directory to keep mv atomic within same filesystem
+out="$(mktemp ./XXXXXX)"
+# Sort JSON keys deterministically and write back atomically
+jq -S . "$1" > "$out" && mv "$out" "$1"