Fix Role Prompt, bypass buggy secrets check, add lsb_release #971
Conversation
|
Warning Rate limit exceeded@Nuru has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 10 minutes and 17 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis pull request updates environment variable configurations and AWS file paths. In the Dockerfile, AWS configuration variables are removed, and a new CHAMBER variable is introduced. The Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (10)
rootfs/etc/profile.d/chamber.sh (2)
1-1: Consider Adding a Shebang Directive.Although profile scripts are typically sourced, adding a shebang (or a shellcheck directive) helps clarify the intended interpreter if the script is ever executed directly.
🧰 Tools
🪛 Shellcheck (0.10.0)
[error] 1-1: Tips depend on target shell and yours is unknown. Add a shebang or a 'shell' directive.
(SC2148)
19-22: Quote Variables in Conditional Checks.To avoid potential word-splitting or globbing issues, please quote the variable expansions in the conditional. For example:
-if [[ -z $CHAMBER_KMS_KEY_ALIAS ]] && [[ -n $CHAMBER_KMS_ALIAS ]]; then - export CHAMBER_KMS_KEY_ALIAS=$CHAMBER_KMS_ALIAS - unset CHAMBER_KMS_ALIAS -fi +if [[ -z "$CHAMBER_KMS_KEY_ALIAS" ]] && [[ -n "$CHAMBER_KMS_ALIAS" ]]; then + export CHAMBER_KMS_KEY_ALIAS="$CHAMBER_KMS_ALIAS" + unset CHAMBER_KMS_ALIAS +firootfs/etc/profile.d/aws.sh (8)
118-120: Ensure Proper Quoting in AWS_VAULT Check.Quote the expansion for added robustness. For example:
-[[ ${AWS_VAULT_ENABLED:-false} == "true" ]] || unset AWS_VAULT +[[ "${AWS_VAULT_ENABLED:-false}" == "true" ]] || unset AWS_VAULT
126-153: Improve Robustness with Quoted Comparisons.For all string comparisons in this block, quoting the variables helps prevent issues if their values contain spaces or unexpected characters. For example:
- if [[ $profile_arn == $current_role ]]; then + if [[ "$profile_arn" == "$current_role" ]]; thenPlease update similar comparisons throughout this section for consistent robustness.
🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 126-126: Quote the right-hand side of == in [[ ]] to prevent glob matching.
(SC2053)
[warning] 138-138: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 139-139: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
158-163: Quote Variables in Mismatch Reporting.Within the mismatch-handling section, ensure variables like
AWS_PROFILE,AWS_VAULT,profile_arn, andcurrent_roleare quoted when used in conditionals and output. This will prevent unexpected behavior if any of these variables are empty or contain spaces.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 162-162: Declare and assign separately to avoid masking return values.
(SC2155)
137-139: Split Command Substitution from Declaration.To avoid masking return values, consider splitting command substitutions from variable declarations. For example:
- local role_arn=$(printf "%s" "$current_role" | sed 's/:sts:/:iam:/g' | sed 's,:assumed-role/,:role/,') + local role_arn + role_arn=$(printf "%s" "$current_role" | sed 's/:sts:/:iam:/g' | sed 's,:assumed-role/,:role/,')🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 138-138: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 139-139: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
137-140: Consider Using Readarray for Splitting Output.When assigning to
role_name, the command substitution splits output into an array. For improved clarity and to avoid subtle splitting issues, consider usingreadarray(ormapfile) to capture the output. For example:- role_name=($(crudini --get --format=lines "$config_file" | grep "$role_arn" | cut -d' ' -f 3)) + readarray -t role_name < <(crudini --get --format=lines "$config_file" | grep "$role_arn" | awk '{print $3}')🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 138-138: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 139-139: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
169-170: Avoid Masking Return Values in Subshell Assignments.Instead of assigning and exporting in one step, split the assignment to capture the output of
red-n '!mixed!'. For instance:- export ASSUME_ROLE=$(red-n '!mixed!') + tmp=$(red-n '!mixed!') + export ASSUME_ROLE="$tmp"This approach helps ensure that any return values are not inadvertently masked.
🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 169-169: Declare and assign separately to avoid masking return values.
(SC2155)
180-182: Consistent Use of the Role Name Variable.The variable
role_nameis sometimes used as an array (when reading multiple values via command substitution) and at other times as a simple string. For clarity and maintainability, please choose one consistent data type based on the expected number of results.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 181-181: Variable was used as an array but is now assigned a string.
(SC2178)
187-190: Be Cautious When Expanding Arrays.If
role_nameis maintained as an array, ensure that any later usage correctly references its elements (e.g., using an index or proper expansion). If only one value is expected, using a string might simplify the logic.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 187-187: Expanding an array without an index only gives the first element.
(SC2128)
[warning] 188-188: Declare and assign separately to avoid masking return values.
(SC2155)
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
os/debian/Dockerfile.debian(2 hunks)packages.txt(1 hunks)rootfs/etc/profile.d/_10-colors.sh(1 hunks)rootfs/etc/profile.d/aws.sh(2 hunks)rootfs/etc/profile.d/chamber.sh(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- packages.txt
- rootfs/etc/profile.d/_10-colors.sh
🧰 Additional context used
🪛 Shellcheck (0.10.0)
rootfs/etc/profile.d/chamber.sh
[error] 1-1: Tips depend on target shell and yours is unknown. Add a shebang or a 'shell' directive.
(SC2148)
rootfs/etc/profile.d/aws.sh
[warning] 126-126: Quote the right-hand side of == in [[ ]] to prevent glob matching.
(SC2053)
[warning] 138-138: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 139-139: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
[warning] 162-162: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 169-169: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 181-181: Variable was used as an array but is now assigned a string.
(SC2178)
[warning] 187-187: Expanding an array without an index only gives the first element.
(SC2128)
[warning] 188-188: Declare and assign separately to avoid masking return values.
(SC2155)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build-and-push (debian)
🔇 Additional comments (2)
os/debian/Dockerfile.debian (1)
322-328: Workaround for SecretsUsedInArgOrEnv Warning is Clear and Concise.The added block explains why the
CHAMBER_KMS_ALIASvariable is introduced and how it will be used at runtime. Ensure that downstream scripts (like the one inchamber.sh) expect this variable.rootfs/etc/profile.d/aws.sh (1)
124-124: Verify Role Matching Logic.The retrieval of
profile_arnvia the AWS CLI (using the target profile) is key to determining if the current role matches expectations. Please double-check that the use ofcut -d/ -f1-2reliably extracts the intended segments of the ARN across various environments.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (11)
rootfs/etc/profile.d/chamber.sh (2)
1-1: Add a Shell Directive for Static Analysis
The file currently lacks a shebang or a ShellCheck directive, which triggers a static analysis warning (SC2148). If this script is intended to be executed directly, consider adding a shebang (e.g.,#!/bin/bash). If it is only meant to be sourced (as is common for scripts in profile.d), you can instead add a ShellCheck comment (e.g.,# shellcheck shell=bash) to clarify the expected shell and suppress the warning.🧰 Tools
🪛 Shellcheck (0.10.0)
[error] 1-1: Tips depend on target shell and yours is unknown. Add a shebang or a 'shell' directive.
(SC2148)
19-22: Ensure Shell Portability in Conditional Expressions
The conditional block uses Bash-specific[[ … ]]expressions. If there is any chance that this script may be sourced in a non-Bash shell environment, consider switching to the POSIX-compliant[ … ]test syntax to enhance compatibility. For example, you might update the block as follows:-if [[ -z "$CHAMBER_KMS_KEY_ALIAS" ]] && [[ -n "$CHAMBER_KMS_ALIAS" ]]; then +if [ -z "$CHAMBER_KMS_KEY_ALIAS" ] && [ -n "$CHAMBER_KMS_ALIAS" ]; thenIf you are certain that Bash will always be used, the current implementation is acceptable.
rootfs/etc/profile.d/aws.sh (9)
110-112: Variable Declaration with Assignment
The update (line 110–112) declaresrole_nameandrole_namesand immediately assignscurrent_roleusing command substitution. Shellcheck warns (SC2155) about combining declaration with assignment, as it can mask return values. Consider separating the declaration from the assignment for improved clarity and safety. For example:- local current_role=$(aws sts get-caller-identity --output text --query 'Arn' 2>/dev/null | cut -d/ -f1-2) + local current_role + current_role=$(aws sts get-caller-identity --output text --query 'Arn' 2>/dev/null | cut -d/ -f1-2)🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 112-112: Declare and assign separately to avoid masking return values.
(SC2155)
134-168: Enhanced Role Name Extraction for Default/Identity Profiles
Within theif [[ $profile_target == "default" ]] || [[ $profile_target =~ -identity$ ]]block, the logic now makes an effort to derive a more descriptive role name (e.g. for Identity Center roles) by parsing the AWS configuration file usingcrudiniand text processing. This enhancement should help users avoid overly generic role names. Consider validating that the regular expressions and field separations (viacut) cover all expected ARN formats.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 145-145: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 148-148: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 151-151: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 154-154: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
170-182: Normal IAM Role Extraction via sed Adjustments
In the “Normal IAM role” branch, the STS ARN is transformed into an IAM role ARN using chainedsedcommands, and then matching profiles are gathered from the config file. While this is a clever solution, please verify that thesedexpressions correctly cover all valid ARN variations and that the array assignment via command substitution is robust in your typical deployment environments.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 172-172: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 173-173: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
184-187: Fallback to Generic Profile Name
If no better match is found, the code now falls back to using the generic profile name. While this guarantees thatASSUME_ROLEis always set, it might be useful to log a warning here to indicate that a fallback was needed. This can aid in debugging potential misconfigurations later.
189-205: AWS Credentials Mismatch Handling
The mismatch-handling block explicitly warns when the current role (as determined by STS) does not match whatAWS_PROFILE(orAWS_VAULT) indicates. The use of red-colored messages and settingASSUME_ROLEto a marker (!mixed!) is clear from a user feedback perspective. However, consider whether simply marking it is sufficient or if it would be better to prompt for re-selection or even exit with an error under certain conditions.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 196-196: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 203-203: Declare and assign separately to avoid masking return values.
(SC2155)
213-217: Role Name Extraction from Credentials File
The update retrieves a potential role name from the shared credentials file usingcrudiniand text processing. This fallback mechanism is valuable. Just be mindful that if the file’s format changes or contains extra entries, the use ofhead -1may not always pick the ideal match.
220-224: Fallback Role Name Retrieval from AWS Config File
If the credentials file does not yield a role name, the code then checks the AWS config file. The transformation of thecurrent_roleinto an IAM role ARN (viased) and the subsequent extraction usingcrudiniis consistent with earlier logic. Please ensure that these text manipulations reliably handle all cases, especially if AWS updates its ARN formats in the future.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 222-222: Declare and assign separately to avoid masking return values.
(SC2155)
226-244: Generating a Fallback Role Name When None is Found
When no profile name is determined from the various lookups, the script now generates a fallback name. In the branch handling Identity Center roles, account ID and SSO role name are extracted from the ARN. While this fallback is a practical solution, consider whether it might be beneficial to log this occurrence with a warning level to alert users that an expected profile name was not found.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 234-234: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 236-236: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 238-238: Declare and assign separately to avoid masking return values.
(SC2155)
112-112: Addressing Shellcheck Warnings (SC2155 & SC2207)
Multiple command substitutions paired with variable declarations (e.g. at lines 112, 125, 145, etc.) have been flagged by Shellcheck. Although these may not impact functionality immediately, refactoring such lines to separate the declaration from the assignment can prevent potential masking of return values and improve readability.
For instance, consider changing:- local current_role=$(aws sts get-caller-identity --output text --query 'Arn' 2>/dev/null | cut -d/ -f1-2) + local current_role + current_role=$(aws sts get-caller-identity --output text --query 'Arn' 2>/dev/null | cut -d/ -f1-2)Please review similar patterns elsewhere in the script.
Also applies to: 124-124, 145-145, 148-148, 151-151, 154-154, 172-172, 173-173, 196-196, 203-203, 222-222, 234-234, 236-236, 238-238
🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 112-112: Declare and assign separately to avoid masking return values.
(SC2155)
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
rootfs/etc/profile.d/aws.sh(2 hunks)rootfs/etc/profile.d/chamber.sh(1 hunks)
🧰 Additional context used
🪛 Shellcheck (0.10.0)
rootfs/etc/profile.d/aws.sh
[warning] 112-112: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 145-145: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 148-148: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 151-151: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 154-154: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
[warning] 172-172: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 173-173: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
[warning] 196-196: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 203-203: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 222-222: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 234-234: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 236-236: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 238-238: Declare and assign separately to avoid masking return values.
(SC2155)
rootfs/etc/profile.d/chamber.sh
[error] 1-1: Tips depend on target shell and yours is unknown. Add a shebang or a 'shell' directive.
(SC2148)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build-and-push (debian)
🔇 Additional comments (4)
rootfs/etc/profile.d/aws.sh (4)
64-77: Consistent AWS Credentials & Config File Fallbacks
The modifiedaws_choose_rolenow uses fallbacks based on${GEODESIC_AWS_HOME}(i.e.${GEODESIC_AWS_HOME}/credentialsand${GEODESIC_AWS_HOME}/config) to source AWS configuration. This approach improves consistency with the overall script design.
118-120: Clearing AWS_VAULT When Not Enabled
The concise use of the conditional expression
[[ "${AWS_VAULT_ENABLED:-false}" == "true" ]] || unset AWS_VAULT
effectively ensures thatAWS_VAULTis cleared when not enabled. This logic is both succinct and clear; please double-check downstream dependencies to be sure that unsettingAWS_VAULTdoes not cause any side effects.
124-127: Retrieving Profile ARN for Role Comparison
The new code block retrieves the profile’s ARN via the AWS CLI using the determinedprofile_targetand then extracts the base ARN portion withcut. This is a key step to later compare it with the current role ARN. Make sure the command handles errors gracefully (e.g. in cases where the AWS CLI might not return the expected output).
207-210: Clarification of the API Keys Scenario
This comment block clarifies that when neitherAWS_VAULTnorAWS_PROFILEis in use, the script will try alternative methods to determine a role name, likely because API keys are directly set. The descriptive comments help in understanding the control flow—no changes required but clarity is appreciated.
|
@coderabbitai how do I suppress SC2155 |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain@Nuru The ShellCheck warning SC2155 occurs when you declare and assign a variable in the same statement (e.g., You can suppress it in several ways:
Would you like me to help you implement any of these solutions in specific files? 🏁 Script executed: Length of output: 866 🌐 Web query: 💡 Result: ShellCheck warning SC2155 occurs when a variable is declared (using Key Issues Addressed by SC2155:
How to Fix:Refactor declarations and assignments into separate steps: # Before (triggers SC2155)
readonly SCRIPT_FILE="$(readlink -f "$0")"
# After (no warning)
SCRIPT_FILE="$(readlink -f "$0")"
readonly SCRIPT_FILEFor variables like # Before
export PATH="$(custom_path)"
# After
PATH="$(custom_path)"
export PATHSuppressing SC2155:
Exceptions:
Citations:
@Nuru To suppress ShellCheck warning SC2155 (which warns about declaring and assigning a variable in a single statement), you have several options:
Would you like me to help implement any of these solutions in specific files in your repository? 🏁 Script executed: Length of output: 562 @Nuru I can see your repository already uses shellcheck directives in some files (like
Would you like me to locate specific instances of SC2155 in your files and suggest fixes for them? |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain@Nuru There are several ways to suppress ShellCheck warning SC2155 ("Declare and assign separately to avoid masking return values"):
#!/bin/bash Check if there's a ShellCheck configuration file in the repositoryecho "Checking for ShellCheck configuration files:" Check if there are any specific shellcheck directives already in the codebaseecho -e "\nChecking for existing ShellCheck directives:" Look for examples that might trigger SC2155 in shell scriptsecho -e "\nChecking for potential SC2155 triggers in shell scripts:" Show the SC2155 warning description directly from ShellCheck if availableecho -e "\nAttempting to get SC2155 description from ShellCheck:" shellcheck disable=SC2155export VAR=$(command)
The proper fix (rather than suppression) is to declare and assign separately: This second approach is generally preferred as it allows you to check the return status of the command before exporting. 🏁 Script executed: Length of output: 69785 🏁 Script executed:
Looking at your codebase, I see you already use shellcheck directives in some files like Alternatively, you could fix the warning by declaring and assigning separately:
Based on your existing code style, the inline method is most consistent with how you're already using ShellCheck directives in other files like 🏁 Script executed: Length of output: 12092 @Nuru To suppress ShellCheck warning SC2155 (declaring and assigning a variable in the same statement), you have three options:
Looking at your If you prefer to fix the warnings instead of suppressing them, separate the declaration from the assignment: # Instead of
export VAR=$(command)
# Do this
VAR=$(command)
export VARThe inline method is generally recommended for isolated cases, while file-level suppression works well if there are many instances in a single file. |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
rootfs/etc/profile.d/aws.sh (2)
137-167: Complex Role Name Extraction Logic.
The nested conditional block for extracting a more descriptive role name—especially for Identity Center roles—is comprehensive. However, its complexity could affect maintainability. Consider refactoring this logic into a dedicated helper function to improve clarity in future maintenance.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 157-157: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
258-258: Quote Parameter Expansion in the stat Command.
Thestatcommand uses a parameter expansion for determining the modification time of the credentials file. To avoid any word-splitting issues (especially if the path contains spaces), enclose the expansion in quotes as shown below:- local credentials_mtime=$(stat -c "%Y" ${AWS_SHARED_CREDENTIALS_FILE:-"${GEODESIC_AWS_HOME}/credentials"} 2>/dev/null) + local credentials_mtime=$(stat -c "%Y" "${AWS_SHARED_CREDENTIALS_FILE:-${GEODESIC_AWS_HOME}/credentials}" 2>/dev/null)This ensures that the file path is properly interpreted.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
rootfs/etc/profile.d/aws.sh(4 hunks)
🧰 Additional context used
🪛 Shellcheck (0.10.0)
rootfs/etc/profile.d/aws.sh
[warning] 157-157: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
[warning] 176-176: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build-and-push (debian)
🔇 Additional comments (7)
rootfs/etc/profile.d/aws.sh (7)
2-4: Clarify ShellCheck Directive.
The inline directive and accompanying comment clearly explain why SC2155 is suppressed. This is acceptable in this context given that the script intentionally does not check the return values here.
68-68: Update AWS Credential and Config File Defaults.
Thecatcommand now uses default paths based on${GEODESIC_AWS_HOME}for both credentials and config files. This change aligns with the PR objective of consolidating AWS configuration paths. Please verify that all parts of the script consistently reference these new defaults.
113-113: Use of Local Variable Declarations.
Declaringrole_nameandrole_namesas local variables is a good practice that limits their scope.
121-123: Effective Handling of AWS_VAULT Configuration.
ClearingAWS_VAULTwhen it isn’t enabled is handled concisely with the inline conditional. This ensures that extraneous settings do not persist in the environment.
128-128: Profile ARN Retrieval.
The use ofaws --profile "${profile_target}" ...to fetch the role ARN is clear and the redirection of errors helps keep the output clean. Verify that this silent failure behavior is intended in all scenarios.
130-130: Role Matching Check.
The check comparing"$profile_arn"to"$current_role"is direct and effectively ensures that the active ARN matches the expected profile.
1-271: Overall Consistency in AWS Configuration Handling.
The modifications made throughout the script ensure that AWS configuration and credential file paths now consistently reference${GEODESIC_AWS_HOME}. This unified approach reduces ambiguity and potential conflicts that could arise from defaulting to disparate paths. Excellent work aligning these changes with the PR objectives.🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 105-105: Use "$@" (with quotes) to prevent whitespace problems.
(SC2048)
[warning] 157-157: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
[warning] 176-176: Prefer mapfile or read -a to split command output (or quote to avoid splitting).
(SC2207)
[warning] 260-260: Quote the right-hand side of != in [[ ]] to prevent glob matching.
(SC2053)
what
CHAMBER_KMS_KEY_ALIASviaCHAMBER_KMS_ALIASlsb-releasepackage to providelsb_releasewhy
CHAMBER_KMS_KEY_ALIASas is customary in Cloud Posse Dockerfiles triggers theSecretsUsedInArgOrEnvwarning. While this is arguably a bug in the warning, this change allows concerned users to avoid the issue.lsb_releaseto be already installedreferences
chamberKMS key alias