ci: add lint check to prevent single quotes in bootstrap scripts (coder#22664)

Kacper Sawicki · web-flow · commit ba051889342f · 2026-03-06T13:09:56.000+01:00
## Problem Bootstrap scripts under `provisionersdk/scripts/` are inlined into templates via `sh -c '${init_script}'`. Any single quote (apostrophe) in these `.sh` files silently breaks the shell quoting, causing the agent to never start — with near-invisible error output. ## Changes - **`scripts/check_bootstrap_quotes.sh`** — new lint script that scans all `.sh` files under `provisionersdk/scripts/` for single quotes and fails with a clear error if any are found. Only checks shell scripts (not `.ps1`, which legitimately uses single quotes). - **`Makefile`** — added `lint/bootstrap` target wired into the `lint` dependency list. Fixes coder#22062
diff --git a/Makefile b/Makefile
@@ -606,7 +606,7 @@ endif
 # GitHub Actions linters are run in a separate CI job (lint-actions) that only
 # triggers when workflow files change, so we skip them here when CI=true.
 LINT_ACTIONS_TARGETS := $(if $(CI),,lint/actions/actionlint)
-lint: lint/shellcheck lint/go lint/ts lint/examples lint/helm lint/site-icons lint/markdown lint/check-scopes lint/migrations $(LINT_ACTIONS_TARGETS)
+lint: lint/shellcheck lint/go lint/ts lint/examples lint/helm lint/site-icons lint/markdown lint/check-scopes lint/migrations lint/bootstrap $(LINT_ACTIONS_TARGETS)
 .PHONY: lint
 
 lint/site-icons:
@@ -636,6 +636,11 @@ lint/shellcheck: $(SHELL_SRC_FILES)
 	shellcheck --external-sources $(SHELL_SRC_FILES)
 .PHONY: lint/shellcheck
 
+lint/bootstrap:
+	bash scripts/check_bootstrap_quotes.sh
+.PHONY: lint/bootstrap
+
+
 lint/helm:
 	cd helm/
 	make lint
diff --git a/scripts/check_bootstrap_quotes.sh b/scripts/check_bootstrap_quotes.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# shellcheck source=scripts/lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+cdroot
+
+echo "--- check bootstrap scripts for single quotes"
+
+files=$(find provisionersdk/scripts -type f -name '*.sh')
+found=0
+for f in $files; do
+	if grep -n "'" "$f"; then
+		echo "ERROR: $f contains single quotes (apostrophes)."
+		echo "       Bootstrap scripts are inlined via sh -c '...' in templates."
+		echo "       Single quotes break this quoting. Use alternative phrasing."
+		found=1
+	fi
+done
+
+if [ "$found" -ne 0 ]; then
+	exit 1
+fi
+
+echo "OK: no single quotes found in bootstrap scripts."
