NVIDIA / NVIDIA/cccl

[BUG]: Unquoted array expansions in CI shell scripts

Open
#8,736 1 comment 0 reactions 1 assignee Claimed by @elstehle View on GitHub
needs triage
Dominant language
C++
Stars
2.5k
Forks
486
Avg merge
2d 6h
Merged PRs (30d)
295

Description

### Is this a duplicate?

- [x] I have searched the [open bugs](https://github.com/NVIDIA/cccl/issues) and this is not a duplicate

### Type of Bug

Something else

### Component

Infrastructure

### Describe the bug

Several CI scripts use `${array[@]}` without double quotes in `for` loops. Without quotes, array elements are re-split on whitespace and subject to glob expansion. If an element ever contains a space or glob character, the loop will silently malfunction.

**Unquoted `for` loops (SC2068) — 4 sites:**
- `ci/upload_cub_test_artifacts.sh:53`
- `ci/test_cub.sh:136`
- `ci/test_thrust.sh:59`
- `ci/upload_thrust_test_artifacts.sh:36`

```bash
# Current — elements re-split on spaces:
for preset_variant in ${preset_variants[@]}; do

# Fixed — element boundaries preserved:
for preset_variant in "${preset_variants[@]}"; do
```

**Implicit array concatenation in `[[ ]]` (SC2199) — 3 sites:**
- `ci/upload_cub_test_artifacts.sh:78`
- `ci/upload_thrust_test_artifacts.sh:47,71`

Uses `${array[@]}` which implicitly concatenates in `[[ ]]`. `${array[*]}` makes concatenation explicit (identical behavior).

**Array in string context (SC2145) — 1 site:**
- `ci/util/extract_switches.sh:67`

**Command output executed as command (SC2091) — 1 site:**
- `ci/build_cuda_cccl_wheel.sh:26`: `if $(git rev-parse --is-shallow-repository)` executes the text output ("true"/"false") as a shell command. Works because `true`/`false` are builtins, but any unexpected output would be executed.

```bash
# Current — executes output as command:
if $(git rev-parse --is-shallow-repository); then

# Fixed — string comparison:
if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
```

Current values contain no spaces, so these work today. The fixes preserve identical behavior while preventing future regressions.

Found via ShellCheck 0.11.0 ([SC2068](https://www.shellcheck.net/wiki/SC2068), [SC2199](https://www.shellcheck.net/wiki/SC2199), [SC2145](https://www.shellcheck.net/wiki/SC2145), [SC2091](https://www.shellcheck.net/wiki/SC2091)).

### How to Reproduce

```bash
shellcheck -e SC1091 ci/upload_cub_test_artifacts.sh ci/test_cub.sh ci/test_thrust.sh ci/upload_thrust_test_artifacts.sh ci/util/extract_switches.sh ci/build_cuda_cccl_wheel.sh
```

### Expected behavior

Array expansions should be double-quoted to prevent word splitting and glob expansion. Command output should not be executed as a command.

### OS

N/A (CI scripts)

### nvidia-smi

N/A

### NVCC version

N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.