IDX-2719 - Switch to bazel for shfmt pre-commit

.pre-commit-config.yaml

@@ -44,8 +44,6 @@ repos:
     exclude: |
       (?x)(
       )
-  - id: shfmt
-    args: ["-w", "-i", "4", "-bn", "-ci"]
   - id: nixpkgs-fmt
     exclude: |
         (?x)^(

BUILD.bazel

@@ -41,6 +41,11 @@ alias(
     actual = "//rs/bazelifier",
 )
 
+alias(
+    name = "shfmt-format",
+    actual = "//bazel/pre-commit:shfmt-format",
+)
+
 alias(
     name = "rustfmt",
     actual = "@rules_rust//:rustfmt",

WORKSPACE.bazel

@@ -347,6 +347,11 @@ load("//bazel:trivy.bzl", "trivy_scan")
 
 trivy_scan(name = "trivy")
 
+# shfmt binary for fast shell linting
+load("//bazel:shfmt.bzl", "shfmt")
+
+shfmt(name = "shfmt")
+
 # ruff binary for fast python linting
 load("//bazel/pre-commit:ruff.bzl", "ruff")
 

bazel/pre-commit/BUILD.bazel

@@ -80,6 +80,46 @@ sh_test(
     ],
 )
 
+sh_test(
+    name = "shfmt-lint",
+    size = "small",
+    srcs = ["shfmt-lint.sh"],
+    data = [
+        "//:WORKSPACE.bazel",
+        "@shfmt",
+    ],
+    env = {
+        # Hack to escape the sandbox and grep on the actual repository
+        "WORKSPACE": "$(rootpath //:WORKSPACE.bazel)",
+        "shfmt_path": "$(rootpath @shfmt//:shfmt)",
+    },
+    tags = [
+        "external",  # force test to be unconditionally executed.
+        "local",  # precludes the action or test from being remotely cached, remotely executed, or run inside the sandbox.
+        "smoke",  # it should be run before committing code changes into the version control system.
+    ],
+)
+
+sh_binary(
+    name = "shfmt-format",
+    srcs = ["shfmt-format.sh"],
+    data = [
+        "//:WORKSPACE.bazel",
+        "@shfmt",
+    ],
+    env = {
+        # Hack to escape the sandbox and grep on the actual repository
+        "WORKSPACE": "$(rootpath //:WORKSPACE.bazel)",
+        "shfmt_path": "$(rootpath @shfmt//:shfmt)",
+    },
+    tags = [
+        "external",  # force test to be unconditionally executed.
+        "local",  # precludes the action or test from being remotely cached, remotely executed, or run inside the sandbox.
+        "smoke",  # it should be run before committing code changes into the version control system.
+    ],
+    visibility = ["//visibility:public"],
+)
+
 sh_test(
     name = "DFINITY-capitalization",
     size = "small",

bazel/pre-commit/shfmt-format.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+SHFMT="$(readlink "$shfmt_path")"
+REPO_PATH="$(dirname "$(readlink "$WORKSPACE")")"
+cd "$REPO_PATH"
+
+find . -type f -name "*.sh" -exec "$SHFMT" -w -i 4 -bn -ci {} \+

bazel/pre-commit/shfmt-lint.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SHFMT="$(readlink "$shfmt_path")"
+REPO_PATH="$(dirname "$(readlink "$WORKSPACE")")"
+cd "$REPO_PATH"
+
+if ! find . -type f -name "*.sh" -exec "$SHFMT" -d -w -i 4 -bn -ci {} \+; then
+    cat >&2 <<EOF
+
+[-] Linting Bash script failed
+    Please run the following command to fix it:
+    $ bazel run //:shfmt-format
+EOF
+    exit 1
+fi

bazel/shfmt.bzl

@@ -0,0 +1,53 @@
+"""
+The module fetches shfmt binary to be used by bazel smoke test
+"""
+
+SHFMT_BUILD = """
+package(default_visibility = ["//visibility:public"])
+exports_files(["shfmt"])
+"""
+
+VERSION = "3.6.0"
+SHA256 = {
+    "darwin_amd64": "b8c9c025b498e2816b62f0b717f6032e9ab49e725a45b8205f52f66318f17185",
+    "darwin_arm64": "633f242246ee0a866c5f5df25cbf61b6af0d5e143555aca32950059cf13d91e0",
+    "linux_amd64": "5741a02a641de7e56b8da170e71a97e58050d66a3cf485fb268d6a5a8bb74afb",
+}
+
+URL = "https://github.com/mvdan/sh/releases/download/v{version}/shfmt_v{version}_{platform}"
+
+FILE_SYM = "shfmt_v{version}_{platform}"
+
+def _shfmt_impl(repository_ctx):
+    os_arch = repository_ctx.os.arch
+
+    if os_arch == "x86_64" or os_arch == "amd64":
+        arch = "amd64"
+    elif os_arch == "aarch64":
+        arch = "arm64"
+    else:
+        fail("Unsupported architecture: '" + os_arch + "'")
+
+    os_name = repository_ctx.os.name
+    if os_name == "linux":
+        platform = "linux_" + arch
+    elif os_name == "mac os x":
+        platform = "darwin_" + arch
+
+    else:
+        fail("Unsupported operating system: " + os_name)
+
+    if platform not in SHA256:
+        fail("Unsupported platform: '" + platform + "'")
+
+    repository_ctx.report_progress("Fetching " + repository_ctx.name)
+    repository_ctx.download(url = URL.format(version = VERSION, platform = platform), sha256 = SHA256[platform], executable = True, output = "shfmt")
+    repository_ctx.file("BUILD.bazel", SHFMT_BUILD, executable = True)
+
+_shfmt = repository_rule(
+    implementation = _shfmt_impl,
+    attrs = {},
+)
+
+def shfmt(name):
+    _shfmt(name = name)

ic-os/boundary-guestos/scripts/build-deployment.sh

@@ -472,17 +472,7 @@ function generate_certificate_issuer_config() {
         esac
     done <"${CERTIFICATE_ISSUER_CREDENTIALS}"
 
-    if [[ -z \
-        "${CERTIFICATE_ORCHESTRATOR_URI}" || -z \
-        "${CERTIFICATE_ORCHESTRATOR_CANISTER_ID}" || -z \
-        "${CERTIFICATE_ISSUER_DELEGATION_DOMAIN}" || -z \
-        "${CERTIFICATE_ISSUER_APPLICATION_DOMAIN}" || -z \
-        "${CERTIFICATE_ISSUER_IDENTITY}" || -z \
-        "${CERTIFICATE_ISSUER_ENCRYPTION_KEY}" || -z \
-        "${CERTIFICATE_ISSUER_ACME_ID}" || -z \
-        "${CERTIFICATE_ISSUER_ACME_KEY}" || -z \
-        "${CERTIFICATE_ISSUER_CLOUDFLARE_API_KEY}" ]] \
-            ; then
+    if [[ -z "${CERTIFICATE_ORCHESTRATOR_URI}" || -z "${CERTIFICATE_ORCHESTRATOR_CANISTER_ID}" || -z "${CERTIFICATE_ISSUER_DELEGATION_DOMAIN}" || -z "${CERTIFICATE_ISSUER_APPLICATION_DOMAIN}" || -z "${CERTIFICATE_ISSUER_IDENTITY}" || -z "${CERTIFICATE_ISSUER_ENCRYPTION_KEY}" || -z "${CERTIFICATE_ISSUER_ACME_ID}" || -z "${CERTIFICATE_ISSUER_ACME_KEY}" || -z "${CERTIFICATE_ISSUER_CLOUDFLARE_API_KEY}" ]]; then
         err "ERROR: Missing certificate-issuer configuration."
         exit_usage
     fi