From 3366463463d9f18c3a9500c35b91838b4ab2e93d Mon Sep 17 00:00:00 2001
From: Johnny Bieren <jbieren@redhat.com>
Date: Fri, 13 Dec 2024 15:14:55 -0500
Subject: [PATCH] fix(RELEASE-1078): linting issues in publish-pyxis-repository

Signed-off-by: Johnny Bieren <jbieren@redhat.com>
---
 tasks/publish-pyxis-repository/README.md      |  3 +++
 .../publish-pyxis-repository.yaml             | 23 ++++++++++--------
 tasks/publish-pyxis-repository/tests/mocks.sh |  2 +-
 ...ository-container-multiple-components.yaml | 24 +++++++++----------
 ...-repository-marked-as-not-pub-on-push.yaml | 12 +++++-----
 ...s-repository-missing-pyxis-repository.yaml |  4 ++--
 ...publish-pyxis-repository-no-data-json.yaml |  4 ++--
 ...sh-pyxis-repository-no-terms-required.yaml | 22 ++++++++---------
 ...lish-pyxis-repository-skip-publishing.yaml | 10 ++++----
 ...xis-repository-source-container-false.yaml | 18 +++++++-------
 ...yxis-repository-source-container-true.yaml | 16 ++++++-------
 .../tests/test-publish-pyxis-repository.yaml  | 22 ++++++++---------
 12 files changed, 83 insertions(+), 77 deletions(-)

diff --git a/tasks/publish-pyxis-repository/README.md b/tasks/publish-pyxis-repository/README.md
index b8370165f..840dfa37a 100644
--- a/tasks/publish-pyxis-repository/README.md
+++ b/tasks/publish-pyxis-repository/README.md
@@ -35,6 +35,9 @@ shouldn't cause any problems, because RHEC will ignore repos with no published i
 | dataPath       | Path to the JSON string of the merged data to use in the data workspace                              | No       |                 |
 | resultsDirPath | Path to the results directory in the data workspace                                                  | No       |                 |
 
+## Changes in 3.0.1
+* Fix shellcheck/checkton linting issues in the task and tests
+
 ## Changes in 3.0.0
 * data json is now mandatory - technically, for some use cases the file is not needed, but requiring it always
   makes it consistent with other tasks and it also makes the task script more readable
diff --git a/tasks/publish-pyxis-repository/publish-pyxis-repository.yaml b/tasks/publish-pyxis-repository/publish-pyxis-repository.yaml
index b2ee4fe13..2a126f201 100644
--- a/tasks/publish-pyxis-repository/publish-pyxis-repository.yaml
+++ b/tasks/publish-pyxis-repository/publish-pyxis-repository.yaml
@@ -4,7 +4,7 @@ kind: Task
 metadata:
   name: publish-pyxis-repository
   labels:
-    app.kubernetes.io/version: "3.0.0"
+    app.kubernetes.io/version: "3.0.1"
   annotations:
     tekton.dev/pipelines.minVersion: "0.12.1"
     tekton.dev/tags: release
@@ -87,7 +87,10 @@ spec:
 
         # Disable trace logging to avoid leaking of cert+key
         set +x
+        # These variables come from the tekton env so disable shellcheck on them
+        # shellcheck disable=SC2154
         echo "${pyxisCert}" > /tmp/crt
+        # shellcheck disable=SC2154
         echo "${pyxisKey}" > /tmp/key
         set -x
 
@@ -115,29 +118,29 @@ spec:
         # Default to false
         skipRepoPublishing="$(jq -r ".pyxis.skipRepoPublishing // false" "${DATA_FILE}")"
 
-        defaultPushSourceContainer=$(jq -r '.mapping.defaults.pushSourceContainer' ${DATA_FILE} || echo false)
+        defaultPushSourceContainer=$(jq -r '.mapping.defaults.pushSourceContainer' "${DATA_FILE}" || echo false)
 
         application=$(jq -r '.application' "${SNAPSHOT_SPEC_FILE}")
         printf 'Beginning "%s" for "%s"\n\n' "$(context.task.name)" "$application"
 
         NUM_COMPONENTS=$(jq '.components | length' "${SNAPSHOT_SPEC_FILE}")
-        for ((i = 0; i < $NUM_COMPONENTS; i++))
+        for ((i = 0; i < NUM_COMPONENTS; i++))
         do
             COMPONENT=$(jq -c --argjson i "$i" '.components[$i]' "${SNAPSHOT_SPEC_FILE}")
             PAYLOAD='{"published":true}'
             COMPONENT_NAME=$(jq -r '.name' <<< "$COMPONENT")
-            REPOSITORY=$(jq -r '.repository' <<< $COMPONENT)
+            REPOSITORY=$(jq -r '.repository' <<< "$COMPONENT")
             PYXIS_REPOSITORY=${REPOSITORY##*/}
             # Replace "----" with "/"
             PYXIS_REPOSITORY=${PYXIS_REPOSITORY//----//}
             PYXIS_REPOSITORY_JSON=$(curl --retry 5 --key /tmp/key --cert /tmp/crt \
                 "${PYXIS_URL}/v1/repositories/registry/${PYXIS_REGISTRY}/repository/${PYXIS_REPOSITORY}" -X GET)
 
-            PYXIS_REPOSITORY_ID=$(jq -r '._id // ""' <<< $PYXIS_REPOSITORY_JSON)
+            PYXIS_REPOSITORY_ID=$(jq -r '._id // ""' <<< "$PYXIS_REPOSITORY_JSON")
             if [ -z "$PYXIS_REPOSITORY_ID" ]; then
                 echo Error: Unable to get Container Repository object id from Pyxis
                 echo "Pyxis response for ${PYXIS_REGISTRY}/${PYXIS_REPOSITORY}:"
-                echo $PYXIS_REPOSITORY_JSON
+                echo "$PYXIS_REPOSITORY_JSON"
                 exit 1
             fi
 
@@ -154,15 +157,15 @@ spec:
 
             # Set source_container_image_enabled based on pushSourceContainer value in components or use default if
             # it is not set in the component
-            if [[ $(jq -r '.pushSourceContainer' <<< $COMPONENT) == "true" ]] ||
-              [[ $(jq 'has("pushSourceContainer")' <<< $COMPONENT) == "false" && \
+            if [[ $(jq -r '.pushSourceContainer' <<< "$COMPONENT") == "true" ]] ||
+              [[ $(jq 'has("pushSourceContainer")' <<< "$COMPONENT") == "false" && \
               ${defaultPushSourceContainer} == "true" ]] ; then
-                PAYLOAD=$(jq -c '. += {"source_container_image_enabled":true}' <<< $PAYLOAD)
+                PAYLOAD=$(jq -c '. += {"source_container_image_enabled":true}' <<< "$PAYLOAD")
             fi
 
             # verify that publish_on_push is set to true.
             # otherwise, do not publish the image.
-            PYXIS_REPOSITORY_PUBLISH_ON_PUSH=$(jq -r '.publish_on_push // "false"' <<< $PYXIS_REPOSITORY_JSON)
+            PYXIS_REPOSITORY_PUBLISH_ON_PUSH=$(jq -r '.publish_on_push // "false"' <<< "$PYXIS_REPOSITORY_JSON")
             if [ "${PYXIS_REPOSITORY_PUBLISH_ON_PUSH}" != "true" ] ; then
               echo "WARNING: repository ${PYXIS_REGISTRY}/${PYXIS_REPOSITORY} is marked as publish_on_push = false"
               echo "Skipping the setting of the published flag."
diff --git a/tasks/publish-pyxis-repository/tests/mocks.sh b/tasks/publish-pyxis-repository/tests/mocks.sh
index 7d657787a..c9c94dae1 100644
--- a/tasks/publish-pyxis-repository/tests/mocks.sh
+++ b/tasks/publish-pyxis-repository/tests/mocks.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 set -eux
 
 # mocks to be injected into task step scripts
diff --git a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-container-multiple-components.yaml b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-container-multiple-components.yaml
index a37564fc3..0940bc471 100644
--- a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-container-multiple-components.yaml
+++ b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-container-multiple-components.yaml
@@ -22,12 +22,12 @@ spec:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               mkdir "$(workspaces.data.path)"/results
 
-              cat > $(workspaces.data.path)/snapshot_spec.json << EOF
+              cat > "$(workspaces.data.path)/snapshot_spec.json" << EOF
               {
                 "application": "my-app",
                 "components": [
@@ -46,7 +46,7 @@ spec:
               }
               EOF
 
-              cat > $(workspaces.data.path)/mydata.json << EOF
+              cat > "$(workspaces.data.path)/mydata.json" << EOF
               {
                 "mapping": {
                   "defaults": {
@@ -83,28 +83,28 @@ spec:
           - name: check-result
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
-              if [ $(cat $(workspaces.data.path)/mock_curl.txt | wc -l) != 6 ]; then
+              if [ "$(wc -l < "$(workspaces.data.path)/mock_curl.txt")" != 6 ]; then
                   echo Error: curl was expected to be called 6 times. Actual calls:
-                  cat $(workspaces.data.path)/mock_curl.txt
+                  cat "$(workspaces.data.path)/mock_curl.txt"
                   exit 1
               fi
 
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 1) \
+              [[ "$(head -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *"/my-product/my-image1 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 2 | tail -n 1) \
+              [[ "$(head -n 2 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *'"source_container_image_enabled":true}' ]]
 
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 3 | tail -n 1) \
+              [[ "$(head -n 3 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/my-product/my-image2 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 4 | tail -n 1) \
+              [[ "$(head -n 4 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   != *'"source_container_image_enabled":true}' ]]
 
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 5 | tail -n 1) \
+              [[ "$(head -n 5 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/my-product/my-image3 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | tail -n 1) \
+              [[ "$(tail -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *'"source_container_image_enabled":true}' ]]
       runAfter:
         - run-task
diff --git a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-marked-as-not-pub-on-push.yaml b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-marked-as-not-pub-on-push.yaml
index 209e6ace1..887e6eb79 100644
--- a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-marked-as-not-pub-on-push.yaml
+++ b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-marked-as-not-pub-on-push.yaml
@@ -21,12 +21,12 @@ spec:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               mkdir "$(workspaces.data.path)"/results
 
-              cat > $(workspaces.data.path)/snapshot_spec.json << EOF
+              cat > "$(workspaces.data.path)/snapshot_spec.json" << EOF
               {
                 "application": "my-app",
                 "components": [
@@ -71,16 +71,16 @@ spec:
           - name: check-result
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
-              if [ $(cat $(workspaces.data.path)/mock_curl.txt | wc -l) != 1 ]; then
+              if [ "$(wc -l < "$(workspaces.data.path)/mock_curl.txt")" != 1 ]; then
                   echo Error: curl was expected to be called 1 time. Actual calls:
-                  cat $(workspaces.data.path)/mock_curl.txt
+                  cat "$(workspaces.data.path)/mock_curl.txt"
                   exit 1
               fi
 
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 1) \
+              [[ "$(head -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *"/my-product/my-image0 "* ]]
       runAfter:
         - run-task
diff --git a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-missing-pyxis-repository.yaml b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-missing-pyxis-repository.yaml
index f2a1b8aff..6364c7794 100644
--- a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-missing-pyxis-repository.yaml
+++ b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-missing-pyxis-repository.yaml
@@ -23,12 +23,12 @@ spec:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               mkdir "$(workspaces.data.path)"/results
 
-              cat > $(workspaces.data.path)/snapshot_spec.json << EOF
+              cat > "$(workspaces.data.path)/snapshot_spec.json" << EOF
               {
                 "application": "my-app",
                 "components": [
diff --git a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-no-data-json.yaml b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-no-data-json.yaml
index 8d1776e52..3c7af39de 100644
--- a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-no-data-json.yaml
+++ b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-no-data-json.yaml
@@ -23,12 +23,12 @@ spec:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               mkdir "$(workspaces.data.path)"/results
 
-              cat > $(workspaces.data.path)/snapshot_spec.json << EOF
+              cat > "$(workspaces.data.path)/snapshot_spec.json" << EOF
               {
                 "application": "my-app",
                 "components": [
diff --git a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-no-terms-required.yaml b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-no-terms-required.yaml
index b6a4ebd35..dfed637d1 100644
--- a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-no-terms-required.yaml
+++ b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-no-terms-required.yaml
@@ -21,12 +21,12 @@ spec:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               mkdir -p "$(workspaces.data.path)/results"
 
-              cat > $(workspaces.data.path)/snapshot_spec.json << EOF
+              cat > "$(workspaces.data.path)/snapshot_spec.json" << EOF
               {
                 "application": "my-app",
                 "components": [
@@ -85,7 +85,7 @@ spec:
           - name: check-result
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               RESULTS_FILE="$(workspaces.data.path)/results/publish-pyxis-repository-results.json"
@@ -120,23 +120,23 @@ spec:
                   exit 1
               fi
 
-              if [ $(cat $(workspaces.data.path)/mock_curl.txt | wc -l) != 6 ]; then
+              if [ "$(wc -l < "$(workspaces.data.path)/mock_curl.txt")" != 6 ]; then
                   echo Error: curl was expected to be called 6 times. Actual calls:
-                  cat $(workspaces.data.path)/mock_curl.txt
+                  cat "$(workspaces.data.path)/mock_curl.txt"
                   exit 1
               fi
 
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 1) \
+              [[ "$(head -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *"/my-product/my-image1 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 2 | tail -n 1) \
+              [[ "$(head -n 2 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/id/1 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 3 | tail -n 1) \
+              [[ "$(head -n 3 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/my-product/my-image5 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 4 | tail -n 1) \
+              [[ "$(head -n 4 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/id/3 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 5 | tail -n 1) \
+              [[ "$(head -n 5 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/my-product/my-image6 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 6 | tail -n 1) \
+              [[ "$(tail -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *"/id/5 "* ]]
 
               EXPECTED_RESULTS='my-product/my-image5
diff --git a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-skip-publishing.yaml b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-skip-publishing.yaml
index 1c797de39..5ba4f8ef3 100644
--- a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-skip-publishing.yaml
+++ b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-skip-publishing.yaml
@@ -21,12 +21,12 @@ spec:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               mkdir "$(workspaces.data.path)"/results
 
-              cat > $(workspaces.data.path)/snapshot_spec.json << EOF
+              cat > "$(workspaces.data.path)/snapshot_spec.json" << EOF
               {
                 "application": "my-app",
                 "components": [
@@ -37,7 +37,7 @@ spec:
               }
               EOF
 
-              cat > $(workspaces.data.path)/data.json << EOF
+              cat > "$(workspaces.data.path)/data.json" << EOF
               {
                 "pyxis": {
                   "skipRepoPublishing": "true"
@@ -72,12 +72,12 @@ spec:
           - name: check-result
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               if [ "$(wc -l < "$(workspaces.data.path)/mock_curl.txt")" != 1 ]; then
                   echo Error: curl was expected to be called once. Actual calls:
-                  cat $(workspaces.data.path)/mock_curl.txt
+                  cat "$(workspaces.data.path)/mock_curl.txt"
                   exit 1
               fi
 
diff --git a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-source-container-false.yaml b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-source-container-false.yaml
index 04b413192..cb3503d9b 100644
--- a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-source-container-false.yaml
+++ b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-source-container-false.yaml
@@ -21,12 +21,12 @@ spec:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               mkdir "$(workspaces.data.path)"/results
 
-              cat > $(workspaces.data.path)/snapshot_spec.json << EOF
+              cat > "$(workspaces.data.path)/snapshot_spec.json" << EOF
               {
                 "application": "my-app",
                 "components": [
@@ -37,7 +37,7 @@ spec:
               }
               EOF
 
-              cat > $(workspaces.data.path)/data.json << EOF
+              cat > "$(workspaces.data.path)/data.json" << EOF
               {
                 "mapping": {
                   "defaults": {
@@ -74,20 +74,20 @@ spec:
           - name: check-result
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
-              if [ $(cat $(workspaces.data.path)/mock_curl.txt | wc -l) != 2 ]; then
+              if [ "$(wc -l < "$(workspaces.data.path)/mock_curl.txt")" != 2 ]; then
                   echo Error: curl was expected to be called 2 times. Actual calls:
-                  cat $(workspaces.data.path)/mock_curl.txt
+                  cat "$(workspaces.data.path)/mock_curl.txt"
                   exit 1
               fi
 
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 1) \
+              [[ "$(head -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *"/my-product/my-image1 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | tail -n 1) \
+              [[ "$(tail -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *"/id/1 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | tail -n 1) \
+              [[ "$(tail -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   != *'{"source_container_image_enabled":true}' ]]
       runAfter:
         - run-task
diff --git a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-source-container-true.yaml b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-source-container-true.yaml
index c5ee74aa1..16f46ff94 100644
--- a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-source-container-true.yaml
+++ b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository-source-container-true.yaml
@@ -22,12 +22,12 @@ spec:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               mkdir "$(workspaces.data.path)"/results
 
-              cat > $(workspaces.data.path)/snapshot_spec.json << EOF
+              cat > "$(workspaces.data.path)/snapshot_spec.json" << EOF
               {
                 "application": "my-app",
                 "components": [
@@ -38,7 +38,7 @@ spec:
               }
               EOF
 
-              cat > $(workspaces.data.path)/mydata.json << EOF
+              cat > "$(workspaces.data.path)/mydata.json" << EOF
               {
                 "mapping": {
                   "defaults": {
@@ -75,18 +75,18 @@ spec:
           - name: check-result
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
-              if [ $(cat $(workspaces.data.path)/mock_curl.txt | wc -l) != 2 ]; then
+              if [ "$(wc -l < "$(workspaces.data.path)/mock_curl.txt")" != 2 ]; then
                   echo Error: curl was expected to be called 2 times. Actual calls:
-                  cat $(workspaces.data.path)/mock_curl.txt
+                  cat "$(workspaces.data.path)/mock_curl.txt"
                   exit 1
               fi
 
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 1) \
+              [[ "$(head -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *"/my-product/my-image1 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | tail -n 1) \
+              [[ "$(tail -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *'"source_container_image_enabled":true}' ]]
       runAfter:
         - run-task
diff --git a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository.yaml b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository.yaml
index 18f5386fb..c025e8e22 100644
--- a/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository.yaml
+++ b/tasks/publish-pyxis-repository/tests/test-publish-pyxis-repository.yaml
@@ -20,12 +20,12 @@ spec:
           - name: setup-values
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               mkdir -p "$(workspaces.data.path)/results"
 
-              cat > $(workspaces.data.path)/snapshot_spec.json << EOF
+              cat > "$(workspaces.data.path)/snapshot_spec.json" << EOF
               {
                 "application": "my-app",
                 "components": [
@@ -84,7 +84,7 @@ spec:
           - name: check-result
             image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
             script: |
-              #!/usr/bin/env sh
+              #!/usr/bin/env bash
               set -eux
 
               RESULTS_FILE="$(workspaces.data.path)/results/publish-pyxis-repository-results.json"
@@ -119,23 +119,23 @@ spec:
                   exit 1
               fi
 
-              if [ $(cat $(workspaces.data.path)/mock_curl.txt | wc -l) != 6 ]; then
+              if [ "$(wc -l < "$(workspaces.data.path)/mock_curl.txt")" != 6 ]; then
                   echo Error: curl was expected to be called 6 times. Actual calls:
-                  cat $(workspaces.data.path)/mock_curl.txt
+                  cat "$(workspaces.data.path)/mock_curl.txt"
                   exit 1
               fi
 
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 1) \
+              [[ "$(head -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *"/my-product/my-image1 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 2 | tail -n 1) \
+              [[ "$(head -n 2 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/id/1 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 3 | tail -n 1) \
+              [[ "$(head -n 3 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/my-product/my-image2 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 4 | tail -n 1) \
+              [[ "$(head -n 4 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/id/3 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 5 | tail -n 1) \
+              [[ "$(head -n 5 "$(workspaces.data.path)/mock_curl.txt" | tail -n 1)" \
                   == *"/my-product/my-image3 "* ]]
-              [[ $(cat $(workspaces.data.path)/mock_curl.txt | head -n 6 | tail -n 1) \
+              [[ "$(tail -n 1 "$(workspaces.data.path)/mock_curl.txt")" \
                   == *"/id/5 "* ]]
 
               SIGN_ACCESS_FILE="$(workspaces.data.path)/$(params.signRegistryAccessPath)"