Merge pull request #172 from opensafely-core/madwort/bash-pipefailetc

chore: use safer bash

justfile

@@ -23,6 +23,8 @@ clean:
 # ensure valid virtualenv
 virtualenv:
     #!/usr/bin/env bash
+    set -euo pipefail
+
     # allow users to specify python version in .env
     PYTHON_VERSION=${PYTHON_VERSION:-$DEFAULT_PYTHON}
 
@@ -35,6 +37,8 @@ virtualenv:
 
 _compile src dst *args: virtualenv
     #!/usr/bin/env bash
+    set -euo pipefail
+
     # exit if src file is older than dst file (-nt = 'newer than', but we negate with || to avoid error exit code)
     test "${FORCE:-}" = "true" -o {{ src }} -nt {{ dst }} || exit 0
     $BIN/pip-compile --allow-unsafe --generate-hashes --output-file={{ dst }} {{ src }} {{ args }}
@@ -53,6 +57,8 @@ requirements-dev *args: requirements-prod
 # ensure prod requirements installed and up to date
 prodenv: requirements-prod
     #!/usr/bin/env bash
+    set -euo pipefail
+
     # exit if .txt file has not changed since we installed them (-nt == "newer than', but we negate with || to avoid error exit code)
     test requirements.prod.txt -nt $VIRTUAL_ENV/.prod || exit 0
 
@@ -62,6 +68,8 @@ prodenv: requirements-prod
 
 _env:
     #!/usr/bin/env bash
+    set -euo pipefail
+
     test -f .env || cp dotenv-sample .env
 
 
@@ -71,6 +79,8 @@ _env:
 # ensure dev requirements installed and up to date
 devenv: _env prodenv requirements-dev && install-precommit
     #!/usr/bin/env bash
+    set -euo pipefail
+
     # exit if .txt file has not changed since we installed them (-nt == "newer than', but we negate with || to avoid error exit code)
     test requirements.dev.txt -nt $VIRTUAL_ENV/.dev || exit 0
 
@@ -81,13 +91,17 @@ devenv: _env prodenv requirements-dev && install-precommit
 # ensure precommit is installed
 install-precommit:
     #!/usr/bin/env bash
+    set -euo pipefail
+
     BASE_DIR=$(git rev-parse --show-toplevel)
     test -f $BASE_DIR/.git/hooks/pre-commit || $BIN/pre-commit install
 
 
 # upgrade dev or prod dependencies (specify package to upgrade single package, all by default)
 upgrade env package="": virtualenv
     #!/usr/bin/env bash
+    set -euo pipefail
+
     opts="--upgrade"
     test -z "{{ package }}" || opts="--upgrade-package {{ package }}"
     FORCE=true {{ just_executable() }} requirements-{{ env }} $opts
@@ -115,6 +129,8 @@ fix: devenv
 
 check-fnm:
     #!/usr/bin/env bash
+    set -euo pipefail
+
     if ! which fnm >/dev/null; then
         echo >&2 "You must install fnm. See https://github.com/Schniz/fnm."
         exit 1