tools: Fixed shellcheck error from promote-stable script
What the developer wrote
Authored by ShahanaFarooqui
tools: Fixed shellcheck error from promote-stable script
Changelog-None: Fixed script.
What changed, and why it matters
This commit is a routine cleanup of a developer/release script. It fixes a shellcheck linting warning and restructures how a Docker Hub login token is requested. There is no security-relevant change: the same credentials are still sent to the same Docker Hub API endpoint, just with slightly different shell syntax and error handling.
No security action needed. Treat as normal maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies tools/promote-stable.sh. It replaces a one-line curl/jq pipeline with a multi-line assignment, adds -fsS to the curl invocation, and uses jq -r ‘.token // empty’ instead of jq -r .token. It also removes the || exit 1 fallback after return. These are stylistic/shellcheck-driven changes; the network destination, request body, and authentication flow remain unchanged. No secrets, cryptography, wire protocol, privilege boundary, or user input validation is altered in a security-relevant way.
Changed components
tools/promote-stable.shInspect captured patch +17 / −3
diff --git a/tools/promote-stable.sh b/tools/promote-stable.sh
index f3efddd6..cd566ce7 100644
--- a/tools/promote-stable.sh
+++ b/tools/promote-stable.sh
@@ -8,12 +8,26 @@ if [ -z "$DOCKER_USERNAME" ] || [ -z "$DOCKER_PASSWORD" ]; then
echo "❌ Oops! Looks like someone forgot their Docker Hub credentials at home!"
echo "🔑 Please set DOCKER_USERNAME and DOCKER_PASSWORD as environment variables."
echo "💡 Hint: We can't log in with 'your-username' and 'your-password' (nice try though!)"
- return 1 2>/dev/null || exit 1
+ return 1 2>/dev/null
+fi
+
+DOCKER_TOKEN=$(
+ curl -fsS \
+ -H "Content-Type: application/json" \
+ -X POST \
+ -d "{\"username\":\"$DOCKER_USERNAME\",\"password\":\"$DOCKER_PASSWORD\"}" \
+ https://hub.docker.com/v2/users/login/ \
+ | jq -r '.token // empty'
+)
+
+if [ -z "$DOCKER_TOKEN" ]; then
+ echo "❌ Failed to obtain Docker Hub token."
+ echo "🔑 Please verify DOCKER_USERNAME and DOCKER_PASSWORD."
+ echo "🌐 Also check your network connectivity."
+ return 1 2>/dev/null
fi
# Get Docker image information
-DOCKER_TOKEN=$(curl -s -H "Content-Type: application/json" -X POST -d "{\"username\": \"$DOCKER_USERNAME\", \"password\": \"$DOCKER_PASSWORD\"}" \
- https://hub.docker.com/v2/users/login/ | jq -r .token)
LATEST_INFO=$(curl -s -H "Authorization: JWT $DOCKER_TOKEN" https://hub.docker.com/v2/repositories/${IMAGE_NAME}/tags/latest/)
LAST_UPDATED=$(echo "$LATEST_INFO" | jq -r .last_updated) || 0
DAYS_OLD=$(( ($(date +%s) - $(date -d "$LAST_UPDATED" +%s)) / 86400 ))
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.