Skip to content

hack: quote YAML_OUTPUT_DIR in rm command to prevent word-splitting - #8990

Closed
Ankitsinghsisodya wants to merge 1 commit into
knative:mainfrom
Ankitsinghsisodya:fix/quote-yaml-output-dir
Closed

Ankitsinghsisodya wants to merge 1 commit into
knative:mainfrom
Ankitsinghsisodya:fix/quote-yaml-output-dir

Conversation

@Ankitsinghsisodya

Copy link
Copy Markdown
Contributor

Fixes #8989

Summary

  • Quote ${YAML_OUTPUT_DIR} in the rm -fr call in hack/generate-yamls.sh

Without quotes, a path containing spaces causes word-splitting and may silently delete files in the wrong location.

Copilot AI review requested due to automatic review settings April 1, 2026 10:23
@knative-prow knative-prow Bot added the area/test-and-release Test infrastructure, tests or release label Apr 1, 2026
@knative-prow
knative-prow Bot requested review from creydr and evankanderson April 1, 2026 10:23
@knative-prow knative-prow Bot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 1, 2026
@knative-prow

knative-prow Bot commented Apr 1, 2026

Copy link
Copy Markdown

Hi @Ankitsinghsisodya. Thanks for your PR.

I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the YAML generation helper script to avoid shell word-splitting risks when cleaning the output directory.

Changes:

  • Quote ${YAML_OUTPUT_DIR} in the rm -fr cleanup command to safely handle paths containing spaces.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread hack/generate-yamls.sh Resolved

@evankanderson evankanderson left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@knative-prow knative-prow Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 2, 2026
Without quotes, a path containing spaces causes incorrect glob
expansion and may silently delete the wrong files or fail unexpectedly.
@Ankitsinghsisodya
Ankitsinghsisodya force-pushed the fix/quote-yaml-output-dir branch from 2ebb215 to a827def Compare April 14, 2026 14:36
@knative-prow knative-prow Bot removed the lgtm Indicates that a PR is ready to be merged. label Apr 14, 2026
@Ankitsinghsisodya

Copy link
Copy Markdown
Contributor Author

@evankanderson

@evankanderson evankanderson left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@knative-prow knative-prow Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 14, 2026
@knative-prow

knative-prow Bot commented Apr 14, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Ankitsinghsisodya, evankanderson
Once this PR has been reviewed and has the lgtm label, please assign upodroid for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@codecov

codecov Bot commented Apr 14, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.06%. Comparing base (6df7e49) to head (a827def).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #8990   +/-   ##
=======================================
  Coverage   51.05%   51.06%           
=======================================
  Files         409      409           
  Lines       21990    21990           
=======================================
+ Hits        11228    11230    +2     
+ Misses       9899     9898    -1     
+ Partials      863      862    -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@knative-prow

knative-prow Bot commented Apr 14, 2026

Copy link
Copy Markdown

@Ankitsinghsisodya: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@Ankitsinghsisodya

Copy link
Copy Markdown
Contributor Author

@evankanderson it failed due to the flaky test. Can you again run the test sir.

Ankitsinghsisodya added a commit to Ankitsinghsisodya/eventing that referenced this pull request Apr 14, 2026
- generate-yamls.sh: quote YAML_OUTPUT_DIR in rm command
- release.sh: quote dirname substitution, REPO_ROOT_DIR in cp, and $@
- verify-codegen.sh: quote REPO_ROOT_DIR inside mktemp call

Unquoted variable expansions and command substitutions break when paths
contain whitespace.

Closes knative#8990
Closes knative#8992
Closes knative#9004
@Ankitsinghsisodya

Copy link
Copy Markdown
Contributor Author

Superseded by #9018, which combines this with #8992 and #9004 into a single PR as requested by @creydr.

knative-prow Bot pushed a commit that referenced this pull request Apr 16, 2026
#9018)

* hack: fix unquoted variables in hack scripts to prevent word-splitting

- generate-yamls.sh: quote YAML_OUTPUT_DIR in rm command
- release.sh: quote dirname substitution, REPO_ROOT_DIR in cp, and $@
- verify-codegen.sh: quote REPO_ROOT_DIR inside mktemp call

Unquoted variable expansions and command substitutions break when paths
contain whitespace.

Closes #8990
Closes #8992
Closes #9004

* hack: use mapfile array for safe multi-file cp in release.sh

Using a quoted space-delimited string with cp treats all paths as a
single argument and breaks with multiple files. Read YAML_LIST into a
local array with mapfile for the cp call, while keeping ARTIFACTS_TO_PUBLISH
as a space-separated string that the upstream knative/hack release.sh
expects.

* hack: remove unused ARTIFACTS_TO_PUBLISH variable

* ci: update actions/checkout to v6 in knative-downstream workflow

* Revert "ci: update actions/checkout to v6 in knative-downstream workflow"

This reverts commit 28805a6.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/test-and-release Test infrastructure, tests or release lgtm Indicates that a PR is ready to be merged. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

hack: unquoted ${YAML_OUTPUT_DIR} in rm command is a word-splitting risk

3 participants