chore: introduce strict bash mode for scripts,.github

REF: #15514

Signed-off-by: Wei Fu <fuweid89@gmail.com>

.github/workflows/build.yaml

@@ -26,6 +26,8 @@ jobs:
       - env:
           TARGET: ${{ matrix.target }}
         run: |
+          set -euo pipefail
+
           echo "${TARGET}"
           case "${TARGET}" in
             linux-amd64)

.github/workflows/contrib.yaml

@@ -9,4 +9,7 @@ jobs:
     - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
       with:
         go-version: "1.19.7"
-    - run: make -C contrib/mixin tools test
+    - run: |
+        set -euo pipefail
+
+        make -C contrib/mixin tools test

.github/workflows/e2e-arm64.yaml

@@ -23,11 +23,12 @@ jobs:
     - env:
         TARGET: ${{ matrix.target }}
       run: |
+        set -euo pipefail
+
         echo "${TARGET}"
         case "${TARGET}" in
           linux-arm64-e2e)
-            PASSES='build release e2e' CPU='4' EXPECT_DEBUG='true' COVER='false' RACE='true' ./scripts/test.sh 2>&1 | tee test.log
-            ! grep -E "(--- FAIL:|FAIL:|DATA RACE|panic: test timed out|appears to have leaked)" -B50 -A10 test.log
+            PASSES='build release e2e' CPU='4' EXPECT_DEBUG='true' COVER='false' RACE='true' ./scripts/test.sh
             ;;
           *)
             echo "Failed to find target"

.github/workflows/e2e.yaml

@@ -19,15 +19,15 @@ jobs:
     - env:
         TARGET: ${{ matrix.target }}
       run: |
+        set -euo pipefail
+
         echo "${TARGET}"
         case "${TARGET}" in
           linux-amd64-e2e)
-            PASSES='build release e2e' CPU='4' EXPECT_DEBUG='true' COVER='false' RACE='true' ./scripts/test.sh 2>&1 | tee test.log
-            ! grep -E "(--- FAIL:|FAIL:|DATA RACE|panic: test timed out|appears to have leaked)" -B50 -A10 test.log
+            PASSES='build release e2e' CPU='4' EXPECT_DEBUG='true' COVER='false' RACE='true' ./scripts/test.sh
             ;;
           linux-386-e2e)
-            GOARCH=386 PASSES='build e2e' CPU='4' EXPECT_DEBUG='true' COVER='false' RACE='true' ./scripts/test.sh 2>&1 | tee test.log
-            ! grep -E "(--- FAIL:|FAIL:|DATA RACE|panic: test timed out|appears to have leaked)" -B50 -A10 test.log
+            GOARCH=386 PASSES='build e2e' CPU='4' EXPECT_DEBUG='true' COVER='false' RACE='true' ./scripts/test.sh
             ;;
           *)
             echo "Failed to find target"

.github/workflows/fuzzing.yaml

@@ -13,7 +13,10 @@ jobs:
     - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
       with:
         go-version: "1.19.7"
-    - run: GOARCH=amd64 CPU=4 make fuzz
+    - run: |
+        set -euo pipefail
+
+        GOARCH=amd64 CPU=4 make fuzz
     - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
       if: failure()
       with:

.github/workflows/govuln.yaml

@@ -10,4 +10,7 @@ jobs:
         with:
           go-version: "1.19.7"
       - run: date
-      - run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./...
+      - run: |
+          set -euo pipefail
+
+          go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./...

.github/workflows/grpcproxy.yaml

@@ -19,15 +19,15 @@ jobs:
     - env:
         TARGET: ${{ matrix.target }}
       run: |
+        set -euo pipefail
+
         echo "${TARGET}"
         case "${TARGET}" in
           linux-amd64-grpcproxy-integration)
-            PASSES='build grpcproxy_integration'  CPU='4' COVER='false' RACE='true' ./scripts/test.sh 2>&1 | tee test.log
-            ! grep -E "(--- FAIL:|FAIL:|DATA RACE|panic: test timed out|appears to have leaked)" -B50 -A10 test.log
+            PASSES='build grpcproxy_integration'  CPU='4' COVER='false' RACE='true' ./scripts/test.sh
             ;;
           linux-amd64-grpcproxy-e2e)
-            PASSES='build grpcproxy_e2e'  CPU='4' COVER='false' RACE='true' ./scripts/test.sh 2>&1 | tee test.log
-            ! grep -E "(--- FAIL:|FAIL:|DATA RACE|panic: test timed out|appears to have leaked)" -B50 -A10 test.log
+            PASSES='build grpcproxy_e2e'  CPU='4' COVER='false' RACE='true' ./scripts/test.sh
             ;;
           *)
             echo "Failed to find target"

.github/workflows/release.yaml

@@ -10,6 +10,8 @@ jobs:
       with:
         go-version: "1.19.7"
     - run: |
+        set -euo pipefail
+
         git config --global user.email "github-action@etcd.io"
         git config --global user.name "Github Action"
         gpg --batch --gen-key <<EOF

.github/workflows/robustness-template.yaml

@@ -29,6 +29,8 @@ jobs:
       env:
         GITHUB_REF: ${{ inputs.ref }}
       run: |
+        set -euo pipefail
+
         case "${GITHUB_REF}" in
           release-3.5)
             make build-failpoints-release-3.5
@@ -45,6 +47,8 @@ jobs:
           esac
     - name: test-robustness
       run: |
+        set -euo pipefail
+
         # Use --failfast to avoid overriding report generated by failed test
         EXPECT_DEBUG=true GO_TEST_FLAGS='-v --count ${{ inputs.count }} --timeout ${{ inputs.testTimeout }} --failfast --run TestRobustness' RESULTS_DIR=/tmp/results make test-robustness
     - uses: actions/upload-artifact@v2

.github/workflows/static-analysis.yaml

@@ -18,5 +18,11 @@ jobs:
         with:
           version: '3.14.0'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-      - run: make verify
-      - run: make fix
+      - run: |
+          set -euo pipefail
+
+          make verify
+      - run: |
+          set -euo pipefail
+
+          make fix

.github/workflows/tests-arm64.yaml

@@ -25,6 +25,8 @@ jobs:
     - env:
         TARGET: ${{ matrix.target }}
       run: |
+        set -euo pipefail
+
         mkdir "${TARGET}"
         export JUNIT_REPORT_DIR=$(realpath ${TARGET})
         case "${TARGET}" in

.github/workflows/tests.yaml

@@ -22,6 +22,8 @@ jobs:
     - env:
         TARGET: ${{ matrix.target }}
       run: |
+        set -euo pipefail
+
         mkdir "${TARGET}"
         export JUNIT_REPORT_DIR=$(realpath ${TARGET})
         case "${TARGET}" in

scripts/build-binary.sh

@@ -1,19 +1,17 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
 source ./scripts/test_lib.sh
 
-VER=$1
+VER=${1:-}
 REPOSITORY="${REPOSITORY:-git@github.com:etcd-io/etcd.git}"
 
-if [ -z "$1" ]; then
+if [ -z "$VER" ]; then
   echo "Usage: ${0} VERSION" >> /dev/stderr
   exit 255
 fi
 
-set -u
-
 function setup_env {
   local ver=${1}
   local proj=${2}
@@ -60,7 +58,7 @@ function main {
   cd release
   setup_env "${VER}" "${proj}"
 
-  tarcmd=tar
+  local tarcmd=tar
   if [[ $(go env GOOS) == "darwin" ]]; then
       echo "Please use linux machine for release builds."
     exit 1

scripts/build-docker.sh

@@ -1,17 +1,23 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
 if [ "$#" -ne 1 ]; then
   echo "Usage: $0 VERSION" >&2
   exit 1
 fi
 
+VERSION=${1}
+if [ -z "$VERSION" ]; then
+  echo "Usage: ${0} VERSION" >&2
+  exit 1
+fi
+
 ARCH=$(go env GOARCH)
-VERSION="${1}-${ARCH}"
+VERSION="${VERSION}-${ARCH}"
 DOCKERFILE="Dockerfile-release.${ARCH}"
 
-if [ -z "${BINARYDIR}" ]; then
+if [ -z "${BINARYDIR:-}" ]; then
   RELEASE="etcd-${1}"-$(go env GOOS)-$(go env GOARCH)
   BINARYDIR="${RELEASE}"
   TARFILE="${RELEASE}.tar.gz"
@@ -34,7 +40,7 @@ cp "${BINARYDIR}"/etcd "${BINARYDIR}"/etcdctl "${BINARYDIR}"/etcdutl "${IMAGEDIR
 
 cat ./"${DOCKERFILE}" > "${IMAGEDIR}"/Dockerfile
 
-if [ -z "$TAG" ]; then
+if [ -z "${TAG:-}" ]; then
     docker build -t "gcr.io/etcd-development/etcd:${VERSION}" "${IMAGEDIR}"
     docker build -t "quay.io/coreos/etcd:${VERSION}" "${IMAGEDIR}"
 else

scripts/build-release.sh

@@ -3,11 +3,11 @@
 # Build all release binaries and images to directory ./release.
 # Run from repository root.
 #
-set -e
+set -euo pipefail
 
 source ./scripts/test_lib.sh
 
-VERSION=$1
+VERSION=${1:-}
 if [ -z "${VERSION}" ]; then
   echo "Usage: ${0} VERSION" >> /dev/stderr
   exit 255

scripts/build.sh

@@ -3,6 +3,8 @@
 # This scripts build the etcd binaries
 # To build the tools, run `build_tools.sh`
 
+set -euo pipefail
+
 source ./scripts/test_lib.sh
 source ./scripts/build_lib.sh
 

scripts/build_lib.sh

@@ -1,18 +1,26 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 source ./scripts/test_lib.sh
 
 GIT_SHA=$(git rev-parse --short HEAD || echo "GitNotFound")
 VERSION_SYMBOL="${ROOT_MODULE}/api/v3/version.GitSHA"
 
+# use go env if noset
+GOOS=${GOOS:-$(go env GOOS)}
+GOARCH=${GOARCH:-$(go env GOARCH)}
+
+GO_BUILD_FLAGS=${GO_BUILD_FLAGS:-}
+
 # Set GO_LDFLAGS="-s" for building without symbols for debugging.
 # shellcheck disable=SC2206
-GO_LDFLAGS=(${GO_LDFLAGS} "-X=${VERSION_SYMBOL}=${GIT_SHA}")
+GO_LDFLAGS=(${GO_LDFLAGS:-} "-X=${VERSION_SYMBOL}=${GIT_SHA}")
 GO_BUILD_ENV=("CGO_ENABLED=0" "GO_BUILD_FLAGS=${GO_BUILD_FLAGS}" "GOOS=${GOOS}" "GOARCH=${GOARCH}")
 
 etcd_build() {
   out="bin"
-  if [[ -n "${BINDIR}" ]]; then out="${BINDIR}"; fi
+  if [[ -n "${BINDIR:-}" ]]; then out="${BINDIR}"; fi
 
   run rm -f "${out}/etcd"
   (
@@ -62,7 +70,7 @@ etcd_build() {
 
 tools_build() {
   out="bin"
-  if [[ -n "${BINDIR}" ]]; then out="${BINDIR}"; fi
+  if [[ -n "${BINDIR:-}" ]]; then out="${BINDIR}"; fi
   tools_path="tools/benchmark
     tools/etcd-dump-db
     tools/etcd-dump-logs

scripts/build_tools.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 source ./scripts/test_lib.sh
 source ./scripts/build_lib.sh
 

scripts/fix.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
 # Top level problems with modules can lead to test_lib being not functional
 go mod tidy

scripts/fuzzing.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-set -e
+
+set -euo pipefail
+
 source ./scripts/test_lib.sh
 
 GO_CMD="go"

scripts/genproto.sh

@@ -3,7 +3,8 @@
 # Generate all etcd protobuf bindings.
 # Run from repository root directory named etcd.
 #
-set -e
+set -euo pipefail
+
 shopt -s globstar
 
 if ! [[ "$0" =~ scripts/genproto.sh ]]; then
@@ -98,7 +99,7 @@ log_callout -e "\\nRunning swagger ..."
 run_go_tool github.com/hexfusion/schwag -input=Documentation/dev-guide/apispec/swagger/rpc.swagger.json
 
 
-if [ "$1" != "--skip-protodoc" ]; then
+if [ "${1:-}" != "--skip-protodoc" ]; then
   log_callout "protodoc is auto-generating grpc API reference documentation..."
 
   # API reference

scripts/install-marker.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-ARCH=$1
+ARCH=${1:-}
 
-if [ -z "$1" ]; then
+if [ -z "$ARCH" ]; then
     echo "Usage: ${0} [amd64 or darwin], defaulting to 'amd64'" >> /dev/stderr
     ARCH=amd64
 fi

scripts/measure-test-flakiness.sh

@@ -1,9 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
-set -e
-set -o pipefail
+set -euo pipefail
 
-if [[ -z ${GITHUB_TOKEN} ]]
+if [[ -z ${GITHUB_TOKEN:-} ]]
 then
     echo "Please set the \$GITHUB_TOKEN environment variable for the script to work"
     exit 1

scripts/release_mod.sh

@@ -10,7 +10,7 @@
 #
 # % DRY_RUN=false REMOTE_REPO="origin" ./scripts/release_mod.sh push_mod_tags
 
-set -e
+set -euo pipefail
 
 source ./scripts/test_lib.sh
 
@@ -55,7 +55,7 @@ function mod_tidy_fix {
 function update_versions_cmd() {
   assert_no_git_modifications || return 2
 
-  if [ -z "${TARGET_VERSION}" ]; then
+  if [ -z "${TARGET_VERSION:-}" ]; then
     log_error "TARGET_VERSION environment variable not set. Set it to e.g. v3.5.10-alpha.0"
     return 2
   fi
@@ -89,7 +89,7 @@ function get_gpg_key {
 function push_mod_tags_cmd {
   assert_no_git_modifications || return 2
 
-  if [ -z "${REMOTE_REPO}" ]; then
+  if [ -z "${REMOTE_REPO:-}" ]; then
     log_error "REMOTE_REPO environment variable not set"
     return 2
   fi

scripts/test.sh

@@ -36,6 +36,7 @@ set -e
 # Consider command as failed when any component of the pipe fails:
 # https://stackoverflow.com/questions/1221833/pipe-output-and-capture-exit-status-in-bash
 set -o pipefail
+set -o nounset
 
 # The test script is not supposed to make any changes to the files
 # e.g. add/update missing dependencies. Such divergences should be 
@@ -46,6 +47,8 @@ export ETCD_VERIFY=all
 source ./scripts/test_lib.sh
 source ./scripts/build_lib.sh
 
+OUTPUT_FILE=${OUTPUT_FILE:-""}
+
 if [ -n "${OUTPUT_FILE}" ]; then
   log_callout "Dumping output to: ${OUTPUT_FILE}"
   exec > >(tee -a "${OUTPUT_FILE}") 2>&1
@@ -55,12 +58,12 @@ PASSES=${PASSES:-"gofmt bom dep build unit"}
 PKG=${PKG:-}
 SHELLCHECK_VERSION=${SHELLCHECK_VERSION:-"v0.8.0"}
 
-if [ -z "$GOARCH" ]; then
+if [ -z "${GOARCH:-}" ]; then
   GOARCH=$(go env GOARCH);
 fi
 
 # determine whether target supports race detection
-if [ -z "${RACE}" ] ; then
+if [ -z "${RACE:-}" ] ; then
   if [ "$GOARCH" == "amd64" ]; then
     RACE="--race"
   else
@@ -72,14 +75,14 @@ fi
 
 # This options make sense for cases where SUT (System Under Test) is compiled by test.
 COMMON_TEST_FLAGS=("${RACE}")
-if [[ -n "${CPU}" ]]; then
+if [[ -n "${CPU:-}" ]]; then
   COMMON_TEST_FLAGS+=("--cpu=${CPU}")
 fi 
 
 log_callout "Running with ${COMMON_TEST_FLAGS[*]}"
 
 RUN_ARG=()
-if [ -n "${TESTCASE}" ]; then
+if [ -n "${TESTCASE:-}" ]; then
   RUN_ARG=("-run=${TESTCASE}")
 fi
 
@@ -120,7 +123,7 @@ function integration_pass {
 
 function e2e_pass {
   # e2e tests are running pre-build binary. Settings like --race,-cover,-cpu does not have any impact.
-  run_for_module "tests" go_test "./e2e/..." "keep_going" : -timeout="${TIMEOUT:-30m}" "${RUN_ARG[@]}" "$@"
+  run_for_module "tests" go_test "./e2e/..." "keep_going" : -timeout="${TIMEOUT:-30m}" "${RUN_ARG[@]}" "$@" || return $?
   run_for_module "tests" go_test "./common/..." "keep_going" : --tags=e2e -timeout="${TIMEOUT:-30m}" "${RUN_ARG[@]}" "$@"
 }
 
@@ -170,8 +173,8 @@ function grpcproxy_e2e_pass {
 
 # Builds artifacts used by tests/e2e in coverage mode.
 function build_cov_pass {
-  run_for_module "server" run go test -tags cov -c -covermode=set -coverpkg="./..." -o "../bin/etcd_test"
-  run_for_module "etcdctl" run go test -tags cov -c -covermode=set -coverpkg="./..." -o "../bin/etcdctl_test"
+  run_for_module "server" run go test -tags cov -c -covermode=set -coverpkg="./..." -o "../bin/etcd_test" || return $?
+  run_for_module "etcdctl" run go test -tags cov -c -covermode=set -coverpkg="./..." -o "../bin/etcdctl_test" || return $?
   run_for_module "etcdutl" run go test -tags cov -c -covermode=set -coverpkg="./..." -o "../bin/etcdutl_test"
 }
 
@@ -256,7 +259,7 @@ function merge_cov {
 
 function cov_pass {
   # shellcheck disable=SC2153
-  if [ -z "$COVERDIR" ]; then
+  if [ -z "${COVERDIR:-}" ]; then
     log_error "COVERDIR undeclared"
     return 255
   fi
@@ -376,6 +379,7 @@ function markdown_you_find_eschew_you {
 }
 
 function markdown_you_pass {
+  # TODO: ./CONTRIBUTING.md:## Get your pull request reviewed
   generic_checker markdown_you_find_eschew_you
 }
 
@@ -391,31 +395,42 @@ function govet_pass {
 }
 
 function govet_shadow_pass {
+  # TODO: we should ignore the generated packages?
+  #
+  # stderr: etcdserverpb/gw/rpc.pb.gw.go:2100:3: declaration of "ctx" shadows declaration at line 2005
   local shadow
   shadow=$(tool_get_bin "golang.org/x/tools/go/analysis/passes/shadow/cmd/shadow")
   run_for_modules generic_checker run go vet -all -vettool="${shadow}"
 }
 
 function unparam_pass {
+  # TODO: transport/listener.go:129:60: newListenConfig - result 1 (error) is always nil
   run_for_modules generic_checker run_go_tool "mvdan.cc/unparam"
 }
 
 function staticcheck_pass {
+  # TODO: we should upgrade pb or ignore the pb package
+  #
+  # versionpb/version.pb.go:69:15: proto.RegisterFile is deprecated: Use protoregistry.GlobalFiles.RegisterFile instead.  (SA1019)
   run_for_modules generic_checker run_go_tool "honnef.co/go/tools/cmd/staticcheck"
 }
 
 function revive_pass {
+  # TODO: etcdserverpb/raft_internal_stringer.go:15:1: should have a package comment
   run_for_modules generic_checker run_go_tool "github.com/mgechev/revive" -config "${ETCD_ROOT_DIR}/tests/revive.toml" -exclude "vendor/..." -exclude "out/..."
 }
 
 function unconvert_pass {
+  # TODO: pb package should be filtered out.
   run_for_modules generic_checker run_go_tool "github.com/mdempsky/unconvert" unconvert -v
 }
 
 function ineffassign_per_package {
-  # bash 3.x compatible replacement of: mapfile -t gofiles < <(go_srcs_in_module "$1")
+  # bash 3.x compatible replacement of: mapfile -t gofiles < <(go_srcs_in_module)
   local gofiles=()
-  while IFS= read -r line; do gofiles+=("$line"); done < <(go_srcs_in_module "$1")
+  while IFS= read -r line; do gofiles+=("$line"); done < <(go_srcs_in_module)
+
+  # TODO: ineffassign should work with package instead of files
   run_go_tool github.com/gordonklaus/ineffassign "${gofiles[@]}"
 }
 
@@ -424,13 +439,14 @@ function ineffassign_pass {
 }
 
 function nakedret_pass {
+  # TODO: nakedret should work with -set_exit_status
   run_for_modules generic_checker run_go_tool "github.com/alexkohler/nakedret"
 }
 
 function license_header_per_module {
-  # bash 3.x compatible replacement of: mapfile -t gofiles < <(go_srcs_in_module "$1")
+  # bash 3.x compatible replacement of: mapfile -t gofiles < <(go_srcs_in_module)
   local gofiles=()
-  while IFS= read -r line; do gofiles+=("$line"); done < <(go_srcs_in_module "$1")
+  while IFS= read -r line; do gofiles+=("$line"); done < <(go_srcs_in_module)
   run_go_tool "github.com/google/addlicense" --check "${gofiles[@]}"
 }
 
@@ -439,9 +455,9 @@ function license_header_pass {
 }
 
 function receiver_name_for_package {
-  # bash 3.x compatible replacement of: mapfile -t gofiles < <(go_srcs_in_module "$1")
+  # bash 3.x compatible replacement of: mapfile -t gofiles < <(go_srcs_in_module)
   local gofiles=()
-  while IFS= read -r line; do gofiles+=("$line"); done < <(go_srcs_in_module "$1")
+  while IFS= read -r line; do gofiles+=("$line"); done < <(go_srcs_in_module)
 
   recvs=$(grep 'func ([^*]' "${gofiles[@]}"  | tr  ':' ' ' |  \
     awk ' { print $2" "$3" "$4" "$1 }' | sed "s/[a-zA-Z\\.]*go//g" |  sort  | uniq  | \
@@ -465,9 +481,9 @@ function receiver_name_pass {
 # checks spelling and comments in the 'package' in the current module
 #
 function goword_for_package {
-  # bash 3.x compatible replacement of: mapfile -t gofiles < <(go_srcs_in_module "$1")
+  # bash 3.x compatible replacement of: mapfile -t gofiles < <(go_srcs_in_module)
   local gofiles=()
-  while IFS= read -r line; do gofiles+=("$line"); done < <(go_srcs_in_module "$1")
+  while IFS= read -r line; do gofiles+=("$line"); done < <(go_srcs_in_module)
   
   local gowordRes
 
@@ -566,7 +582,7 @@ function release_pass {
   rm -f ./bin/etcd-last-release
   # to grab latest patch release; bump this up for every minor release
   UPGRADE_VER=$(git tag -l --sort=-version:refname "v3.5.*" | head -1 | cut -d- -f1)
-  if [ -n "$MANUAL_VER" ]; then
+  if [ -n "${MANUAL_VER:-}" ]; then
     # in case, we need to test against different version
     UPGRADE_VER=$MANUAL_VER
   fi
@@ -618,6 +634,7 @@ function mod_tidy_for_module {
     log_error "${PWD}/go.mod is not in sync with 'go mod tidy'"
     return 255
   fi
+  set -e
 }
 
 function mod_tidy_pass {
@@ -633,8 +650,8 @@ function genproto_pass {
 }
 
 function goimport_for_module {
-  GOFILES=$(run go list  --f "{{with \$d:=.}}{{range .GoFiles}}{{\$d.Dir}}/{{.}}{{\"\n\"}}{{end}}{{end}}" ./...)
-  TESTGOFILES=$(run go list  --f "{{with \$d:=.}}{{range .TestGoFiles}}{{\$d.Dir}}/{{.}}{{\"\n\"}}{{end}}{{end}}" ./...)
+  GOFILES=$(run go list  --f "{{with \$d:=.}}{{range .GoFiles}}{{\$d.Dir}}/{{.}}{{\"\n\"}}{{end}}{{end}}" ./...) || return 2
+  TESTGOFILES=$(run go list  --f "{{with \$d:=.}}{{range .TestGoFiles}}{{\$d.Dir}}/{{.}}{{\"\n\"}}{{end}}{{end}}" ./...) || return 2
   cd "${ETCD_ROOT_DIR}/tools/mod"
   FILESNEEDSFIX=$(echo "${GOFILES}" "${TESTGOFILES}" | grep -v '.gw.go' | grep -v '.pb.go' | xargs -n 100 go run golang.org/x/tools/cmd/goimports -l -local go.etcd.io)
   if [ -n "$FILESNEEDSFIX" ]; then

scripts/test_lib.sh

@@ -105,7 +105,7 @@ function relativePath {
 
 ####   Discovery of files/packages within a go module #####
 
-# go_srcs_in_module [package]
+# go_srcs_in_module
 # returns list of all not-generated go sources in the current (dir) module.
 function go_srcs_in_module {
   go list -f "{{with \$c:=.}}{{range \$f:=\$c.GoFiles  }}{{\$c.Dir}}/{{\$f}}{{\"\n\"}}{{end}}{{range \$f:=\$c.TestGoFiles  }}{{\$c.Dir}}/{{\$f}}{{\"\n\"}}{{end}}{{range \$f:=\$c.XTestGoFiles  }}{{\$c.Dir}}/{{\$f}}{{\"\n\"}}{{end}}{{end}}" ./... | grep -vE "(\\.pb\\.go|\\.pb\\.gw.go)"
@@ -212,7 +212,7 @@ function run_for_modules {
 }
 
 junitFilenamePrefix() {
-  if [[ -z "${JUNIT_REPORT_DIR}" ]]; then
+  if [[ -z "${JUNIT_REPORT_DIR:-}" ]]; then
     echo ""
     return
   fi
@@ -222,7 +222,7 @@ junitFilenamePrefix() {
 }
 
 function produce_junit_xmlreport {
-  local -r junit_filename_prefix=$1
+  local -r junit_filename_prefix=${1:-}
   if [[ -z "${junit_filename_prefix}" ]]; then
     return
   fi
@@ -232,7 +232,7 @@ function produce_junit_xmlreport {
 
   # Ensure that gotestsum is run without cross-compiling
   run_go_tool gotest.tools/gotestsum --junitfile "${junit_xml_filename}" --raw-command cat "${junit_filename_prefix}"*.stdout || exit 1
-  if [ "${VERBOSE}" != "1" ]; then
+  if [ "${VERBOSE:-}" != "1" ]; then
     rm "${junit_filename_prefix}"*.stdout
   fi
 
@@ -290,7 +290,7 @@ function go_test {
 
   junit_filename_prefix=$(junitFilenamePrefix)
 
-  if [ "${VERBOSE}" == "1" ]; then
+  if [ "${VERBOSE:-}" == "1" ]; then
     goTestFlags="-v"
   fi
 

scripts/update_dep.sh

@@ -9,6 +9,8 @@
 #
 # Updates version of given dependency in all the modules that depend on the mod.
 
+set -euo pipefail
+
 source ./scripts/test_lib.sh
 
 mod="$1"

scripts/updatebom.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
+
 source ./scripts/test_lib.sh
 
 function bom_fixlet {

tools/mod/install_all.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 cd ./tools/mod || exit 2
 go list --tags tools -f '{{ join .Imports "\n" }}' | xargs go install