Prevent False Positives in CI (#4642)

PR Summary:

Since all of our CI scripts are run with BASH, we need to make sure that
any unexpected non zero exit code instruction in the script should fail
the CI run.

We need to add the snippet below to all our CI scripts:

```
set -eu -o pipefail
```

.github/workflows/lint.yml

@@ -14,16 +14,34 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
-      - run: echo "GO_VER=$(cat .tool-versions | grep 'golang ' | cut -d' ' -f2)" >> $GITHUB_ENV
-      - run: echo "NODE_VER=$(cat .tool-versions | grep nodejs | cut -d' ' -f2)" >> $GITHUB_ENV
+      - name: Set Go Version
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "GO_VER=$(cat .tool-versions | grep 'golang ' | cut -d' ' -f2)" >> $GITHUB_ENV
+
+      - name: Set Node Version
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "NODE_VER=$(cat .tool-versions | grep nodejs | cut -d' ' -f2)" >> $GITHUB_ENV
 
       - name: Install asdf & tools
         uses: asdf-vm/actions/install@v3
 
       - name: Add asdf to PATH
-        run: echo "~/.asdf/shims" >> $GITHUB_PATH
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "~/.asdf/shims" >> $GITHUB_PATH
 
-      - run: go mod tidy
+      - name: Go Tidy
+        shell: bash
+        run: |
+          set -euo pipefail
+          go mod tidy
       - name: Run pre-commit
+        shell: bash
         run: |
+          set -euo pipefail
           pre-commit run --show-diff-on-failure --color=always --all-files

.github/workflows/swagger-validation.yml

@@ -20,7 +20,9 @@ jobs:
       # Detect Go version from go.mod
       - name: Detect Go version from go.mod
         id: detect-go-version
+        shell: bash
         run: |
+          set -euo pipefail
           go_version=$(grep '^go ' go.mod | awk '{print $2}')
           echo "Go version detected: $go_version"
           echo "golang-version=$go_version" >> $GITHUB_ENV
@@ -34,22 +36,31 @@ jobs:
 
       # Install swag (Swagger generator)
       - name: Install Swag
+        shell: bash
         run: |
+          set -euo pipefail
           go install github.com/swaggo/swag/cmd/swag@latest
 
       # Verify swag installation
       - name: Verify Swag Installation
+        shell: bash
         run: |
+          set -euo pipefail
           if ! command -v swag &> /dev/null; then
             echo "Swag is not installed. Please ensure Go is properly configured and Swag is installed."
             exit 1
           fi
 
       # Generate the swagger.json
       - name: Generate Swagger file
-        run: make generate-swagger
+        shell: bash
+        run: |
+          set -euo pipefail
+          make generate-swagger
 
       # Compare the newly generated swagger.json with the committed swagger.json
       - name: Check for Swagger differences
+        shell: bash
         run: |
+          set -euo pipefail
           git diff --exit-code pkg/swagger/swagger.json || (echo "Swagger is outdated. Please regenerate it with 'make generate-swagger' and commit the changes." && exit 1)

.github/workflows/testcontainers-integration-tests.yml

@@ -18,7 +18,9 @@ jobs:
       # Detect Go version from test_integration/go.mod
       - name: Detect Go version from test_integration/go.mod
         id: detect-test-go-version
+        shell: bash
         run: |
+          set -euo pipefail
           go_version=$(grep '^go ' test_integration/go.mod | awk '{print $2}')
           echo "Go version detected for integration tests: $go_version"
           echo "GOLANG_TEST_VERSION=$go_version" >> $GITHUB_ENV
@@ -30,7 +32,9 @@ jobs:
           cache: true
 
       - name: Run Go tests in integration test directory
+        shell: bash
         run: |
+          set -euo pipefail
           # TODO: make WebUI happy when compiling
           mkdir -p webui/build
           echo "hello test" > webui/build/index.html

.github/workflows/trigger-development-deployment.yaml

@@ -13,7 +13,9 @@ jobs:
         uses: actions/checkout@v2
 
       - name: Trigger Deployment
+        shell: bash
         run: |
+          set -euo pipefail
           curl -X POST \
           -H "Authorization: token ${{ secrets.BACALHAU_VMI_DEPLOYMENT_SECRET }}" \
           -H "Accept: application/vnd.github+json" \

.github/workflows/trigger-ga-vmi-pipeline-on-release.yml

@@ -15,9 +15,11 @@ jobs:
         uses: actions/checkout@v2
 
       - name: Trigger VMI Build
+        shell: bash
         env:
           REPO: ${{ github.repository }}
         run: |
+          set -euo pipefail
           curl -L -X POST \
           -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
           -H "Accept: application/vnd.github.v3+json" \

.github/workflows/trigger-on-comment.yml

@@ -11,7 +11,9 @@ jobs:
     steps:
       - name: Check if commenter is authorized
         id: check-authorization
+        shell: bash
         run: |
+          set -euo pipefail
           COMMENTER=$(jq --raw-output .comment.user.login "$GITHUB_EVENT_PATH")
           APPROVERS=$(yq e '.approvers[]' OWNERS)
           if echo "$APPROVERS" | grep -Fxq "$COMMENTER"; then

buildkite/scripts/build_python_client.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -euo pipefail
 
 setup_environment_variables() {
   export PYPI_TOKEN=$(buildkite-agent secret get PYPI_TOKEN)

buildkite/scripts/build_python_sdk.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -euo pipefail
 
 setup_environment_variables() {
   export PYPI_TOKEN=$(buildkite-agent secret get PYPI_TOKEN)

buildkite/scripts/build_tarball.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -euo pipefail
+
 export PRIVATE_PEM_B64=$(buildkite-agent secret get PRIVATE_PEM_B64)
 export PUBLIC_PEM_B64=$(buildkite-agent secret get PUBLIC_PEM_B64)
 export PRIVATE_KEY_PASSPHRASE_B64=$(buildkite-agent secret get PRIVATE_KEY_PASSPHRASE_B64)

buildkite/scripts/build_webui.sh

@@ -1,3 +1,5 @@
 #!/bin/bash
 
+set -euo pipefail
+
 make build-webui

buildkite/scripts/lint.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
 set -x
 
 # NB(forrest/udit): this step needs to be done before linting as without it the code doesn't compile since webuid/build DNE.
@@ -11,4 +12,3 @@ make lint
 # TODO(forrest/udit): deprecate pre-commit and replace it with the individual steps required to validate the code.
 # e.g. modtidy check, credentials check, go fmt, test file header validation.
 pre-commit run --show-diff-on-failure --color=always --all-files
-

buildkite/scripts/release_cli.sh

@@ -1,6 +1,6 @@
-
 #!/bin/bash
-set -e
+
+set -euo pipefail
 
 set_environment_variables() {
     export BACALHAU_RELEASE_TOKEN=$(buildkite-agent secret get BACALHAU_RELEASE_TOKEN)

buildkite/scripts/test.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -euo pipefail
+
 # Function to set environment variables
 set_environment_variables() {
     export LOG_LEVEL=DEBUG

pkg/executor/docker/executor.go

@@ -355,7 +355,7 @@ func (e *Executor) newDockerJobContainer(ctx context.Context, params *dockerJobC
 
 	if params.Resources.Memory > math.MaxInt64 {
 		return container.CreateResponse{}, fmt.Errorf(
-			"memory value %d exceeds maximum allowed value %d", params.Resources.Memory, math.MaxInt64,
+			"memory value %d exceeds maximum allowed integer value", params.Resources.Memory,
 		)
 	}
 

test_integration/6_jobs_basic_runs_scenarios_suite_test.go

@@ -87,7 +87,7 @@ func (s *JobsBasicRunsScenariosSuite) TestUnsupportedTaskEngineType() {
 			"run",
 			"/bacalhau_integration_tests/common_assets/job_specs/unsupported_engine_type.yml",
 		})
-	s.Require().NoErrorf(err, "Error job: %q", err)
+	s.Require().NoErrorf(err, "Error running job: %q", err)
 	s.Require().Contains(result, "not enough nodes to run job")
 	s.Require().Contains(result, "does not support vroomvroom")
 }

test_integration/common_assets/docker_compose_files/deployment-with-minio-and-registry.yml

@@ -88,6 +88,8 @@ services:
   bacalhau-jumpbox-node:
     image: {{ .JumpboxImageName }}
     privileged: true
+    command: tail -f /dev/null
+    restart: unless-stopped
     networks:
       - bacalhau-network
     depends_on:

test_integration/common_assets/docker_compose_files/orchestrator-node-with-custom-start-command.yml

@@ -30,6 +30,8 @@ services:
   bacalhau-jumpbox-node:
     image: {{ .JumpboxImageName }}
     privileged: true
+    command: tail -f /dev/null
+    restart: unless-stopped
     networks:
       - bacalhau-network
     environment:

test_integration/common_assets/docker_compose_files/orchestrator-node-with-default-start-command.yml

@@ -30,6 +30,8 @@ services:
   bacalhau-jumpbox-node:
     image: {{ .JumpboxImageName }}
     privileged: true
+    command: tail -f /dev/null
+    restart: unless-stopped
     networks:
       - bacalhau-network
     environment:

test_integration/common_assets/dockerfiles/Dockerfile-JumpboxNode

@@ -1,5 +1,5 @@
 # Use the docker:dind image as the base image
-FROM docker:dind
+FROM alpine:latest
 
 # Set the working directory
 WORKDIR /app
@@ -28,5 +28,3 @@ RUN chmod +x /usr/local/bin/bacalhau
 RUN curl -o /tmp/mc https://dl.min.io/client/mc/release/linux-amd64/mc \
     && chmod +x /tmp/mc \
     && mv /tmp/mc /usr/local/bin/
-
-ENTRYPOINT ["dockerd-entrypoint.sh"]

test_integration/common_assets/dockerfiles/Dockerfile-OrchestratorNode

@@ -1,5 +1,5 @@
 # Use the docker:dind image as the base image
-FROM docker:dind
+FROM alpine:latest
 
 # Set the working directory
 WORKDIR /app
@@ -23,5 +23,3 @@ COPY ./ /bacalhau_integration_tests
 # Download and execute the Bash script from the given URL
 COPY ./common_assets/bacalhau_bin /usr/local/bin/bacalhau
 RUN chmod +x /usr/local/bin/bacalhau
-
-ENTRYPOINT ["dockerd-entrypoint.sh"]

test_integration/common_assets/job_specs/hello_world.yml

@@ -6,9 +6,9 @@ Tasks:
     Engine:
       Type: docker
       Params:
-        Image: ubuntu:latest
+        Image: busybox:latest
         Entrypoint:
-          - /bin/bash
+          - /bin/sh
         Parameters:
           - "-c"
           - "echo hello bacalhau world"

test_integration/common_assets/job_specs/unsupported_engine_type.yml

@@ -6,9 +6,9 @@ Tasks:
     Engine:
       Type: vroomvroom
       Params:
-        Image: ubuntu:latest
+        Image: busybox:latest
         Entrypoint:
-          - /bin/bash
+          - /bin/sh
         Parameters:
           - "-c"
           - "echo hello bacalhau world"