Three silent failures of a bare script
Bash defaults are the root of debugging hell: commands do not stop the script (`-e` off), undefined variables act as empty strings (`-u` off), and a pipe only reports the last command’s status (`pipefail` off).
The result is a script that "looks finished" but broke halfway: `cd` fails yet `rm` still runs in the wrong directory, a typo’d variable silently becomes empty, `grep | head` hides an upstream crash. Production incidents hide in exactly these lines.
cd /data/release && rm -rf old/ # cd 失败时 rm 根本不该执行
cp app.conf /etc/app.conf # 失败了脚本照样往下走
echo "deploy done" # 假象：一切都好First line of defense: set -euo pipefail
Put `set -euo pipefail` right after the shebang: `-e` exits on any failing command, `-u` errors on undefined variables instead of treating them as empty, `-o pipefail` makes a pipe adopt the first failure’s exit code.
One caveat about `-e`: failures inside conditional contexts (`if`/`while`/`&&`/`||`) do not trigger exit — that is a feature, and patterns like `cmd || exit 1` still need explicit handling.
#!/usr/bin/env bash
set -euo pipefail
# 调试期可加：逐条回显执行的命令
# set -xClean up with trap
When a script dies midway or gets killed by Ctrl+C, temp files, child processes and lock files are left behind. Hook cleanup onto `EXIT` with `trap`: it runs on normal exit, on error, and on interruption alike.
Create temp dirs with `mktemp -d` (never hardcode paths — avoids concurrency clashes and symlink attacks), and have the cleanup function remove only what it created.
tmpdir=$(mktemp -d)
cleanup() { rm -rf "$tmpdir"; }
trap cleanup EXIT
# 需要 Ctrl+C / kill 也走一遍显式清理时可再加：
# trap cleanup INT TERMQuoting discipline: double-quote every expansion
An unquoted variable splits on spaces and vanishes when empty: `rm -rf $dir` with an empty dir becomes a bare `rm -rf` (disaster-grade). The discipline is simple — always write `"$var"`, never `$var`.
Three common companions: use `--` or a `./` prefix when filenames may start with `-`; use `${1:?message}` to fail fast on required args; use `${2:-default}` for optional ones.
rm -rf -- "$dir" # -- 防止文件名被当成选项
src="${1:?用法: $0 <源目录>}" # 缺参数直接报错退出
out="${2:-./dist}" # 提供默认值Validate inputs, stay idempotent
Validate external inputs (positional args, env vars, find output) before use: check commands with `command -v`, paths with `[ -d ]`/`[ -f ]`. Fail at startup rather than halfway through.
Make scripts idempotent: `mkdir -p` over `mkdir`, `cp -f`/`rsync` over bare `cp`. A half-failed run can then simply be re-run without manual cleanup.
command -v jq >/dev/null || { echo "需要 jq" >&2; exit 1; }
[ -d "$src" ] || { echo "目录不存在: $src" >&2; exit 1; }
mkdir -p "$out" # 幂等：已存在不报错Debugging and the pre-production checklist
Three tools cover ninety percent of issues: `bash -n` checks syntax only, `bash -x` traces every line, and shellcheck statically catches nearly all of the pitfalls above, including unquoted variables. Wire shellcheck into CI and script-quality problems mostly vanish.
Final checklist: shebang + `set -euo pipefail` + trap cleanup + double-quoted expansions + input validation + idempotent operations + shellcheck passing. Copy this skeleton and your scripts go from "good luck" to "trustworthy".
bash -n deploy.sh # 只查语法
bash -x deploy.sh # 逐行回显执行（调试）
shellcheck deploy.sh # 静态分析（推荐装进 CI）