bash-defensive-patterns

Start every script with set -Eeuo pipefail to exit on errors, undefined variables, and pipe failures. Add trap handlers for cleanup, quote all variables, validate inputs before use, and implement structured logging with timestamps.

set -e exits the script when any command returns non-zero, set -u treats unset variables as errors, and set -o pipefail makes pipelines fail if any command in the chain fails. Adding set -E ensures ERR traps are inherited by functions.

Use [[ ]] for Bash-specific scripts because it avoids word splitting and pathname expansion issues, making tests safer. Use [ ] only when POSIX portability across different shells is required.

Create temporary directories with mktemp -d and register a trap on EXIT to remove them automatically. This guarantees cleanup even when the script fails or receives a termination signal.

Unquoted variables cause word splitting on spaces, breaking file operations. Always quote variables like "$file" and use find with -print0 paired with read -d '' for NUL-safe iteration over filenames.

Wrap destructive commands in a run_cmd function that checks a DRY_RUN flag. When enabled, it prints the command instead of executing it, letting users preview changes before applying them.