rose subshells

[oliver-sanders]

Rose applications will run the configured command.

This command will be launched from a Python subshell with shell=True.

This will run the resulting script in /bin/sh, however, which shell /bin/sh is implemented by is unknown. This can lead workflow developers to create apps with portability barriers. E.G, a script might be developed for Bash which is then not portable to OS'es where /bin/sh does not point at /bin/bash.

Additionally, since this is a plain shell set -euo pipefail has not been specified, so [command]default = false; true will exit 0, where some users might expect it to exit 1.

It's not clear what we can sensibly do to handle the /bin/sh issue, however, it looks like at the very least we have a documentation issue, and two possible anti-patterns for a linter to detect (consider a Rose macro?).

[oliver-sanders]

Basic example of a shellchecker macro:

from subprocess import PIPE, Popen
from tempfile import NamedTemporaryFile

from metomi.rose.macro import MacroBase


class CommandChecker(MacroBase):
    '''.'''

    @staticmethod
    def check_command(command):
        with NamedTemporaryFile(mode='w') as tp:
            tp.write('#!/bin/sh\n')
            tp.write(command)
            tp.flush()
            proc = Popen(['shellcheck', tp.name], stderr=PIPE, stdout=PIPE, text=True)
            if proc.wait():
                out, err = proc.communicate()
                return f'Shellcheck error in {out}'
        return None

    def validate(self, config, meta_config=None):
        commands = config.get(['command'])
        if not commands:
            return self.reports

        for command, node in commands.value.items():
            if node is None or node.is_ignored():
                continue
            if node.value:
                if error := self.check_command(node.value):
                    self.add_report('command', command, node.value, error)

        return self.reports