Pebellslearn by building
0%
RoadmapsMatrixCoursesSandboxSign in
DevSecOps Foundations  ›  Capstone Project

Safe Pipeline Scripts

Bash 15 minPipeline shell scripts should stop on the first error, treat unset variables and failed pipes as failures, quote every variable, and never print or download-and-run anything untrusted.

Safe Pipeline Scripts

Every pipeline ends up running shell. Tiffin's deploy stage is twenty lines of Bash that someone wrote in a hurry. Those lines run with the pipeline's credentials, so a careless script can leak a token into a public log or keep deploying after a failed test. Small habits make these scripts safe.

The rule

Fail loudly, quote everything, print no secrets, run nothing unverified.

Start every Bash script with strict mode:

#!/usr/bin/env bash
set -euo pipefail

IMAGE_TAG="${IMAGE_TAG:?IMAGE_TAG must be set}"
run-tests | tee test.log
deploy --tag "$IMAGE_TAG"
  • -e: stop at the first command that fails. Without it, Bash carries on and may deploy after a failed step.
  • -u: using an unset variable is an error, instead of silently becoming an empty string.
  • -o pipefail: a pipeline fails if any part fails. Without it, run-tests | tee test.log reports the exit code of tee, which succeeds even when the tests fail.
  • "$IMAGE_TAG": quotes stop a value containing spaces or wildcards from splitting into several arguments.

PowerShell has matching habits: $ErrorActionPreference = 'Stop' and Set-StrictMode -Version Latest.

Two security habits complete the rule. No secrets in output: never echo a token, and avoid set -x tracing around lines that use one, because build logs are read by many people and kept for a long time. Nothing unverified: curl ... | bash runs whatever a remote server returns today. Use a pinned version and check its published checksum, or bake the tool into the runner image.

The shortcut

Read each line and ask three questions: what if it fails? what if it's empty? who can see it?

Reviewing Tiffin's deploy scriptStep 1 of 4

  1. What if it fails?

    run-tests | tee test.log hides a failing test. Add set -euo pipefail at the top.

Editing these scripts on a server usually happens in a terminal editor such as Vim or Nano. Whichever you use, never paste real secrets into a script file "just to test".

Drills

Answer fast — trust the rule.

quick drill

What does set -e change in a Bash script?

quick drill

Without pipefail, what exit status does run-tests | tee test.log report when the tests fail?

quick drill

Why quote "$IMAGE_TAG" instead of writing $IMAGE_TAG?

quick drill

Which line is the biggest risk in a pipeline script?

Remember

  • Fail loudly, quote everything, print no secrets, run nothing unverified.
  • Ask of each line: what if it fails, what if it's empty, who can see it?
  • set -euo pipefail in Bash; $ErrorActionPreference = 'Stop' in PowerShell.

Practice — level up

0/1 solved

Write your answer, then compare it with a rubric and a model answer.

ExplainReview a deploy script

Review this Tiffin deploy script and explain every security or reliability problem you see, then describe the fixed version: #!/usr/bin/env bash / echo "Using token $DEPLOY_TOKEN" / curl -s https://get.example.com/install.sh | bash / run-tests | tee test.log / deploy --tag $IMAGE_TAG.