fix: resolve ShellCheck issues mentioned in #24675

[georglauterbach]

Closes #24675

PR checklist

• Read the contribution guidelines.
• Run the following to build the project and update samples:

  ./mvnw clean package || exit
  ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
  ./bin/utils/export_docs_generators.sh || exit
  

  (For Windows users, please run the script in WSL)
  Commit all changed files.
  This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
  These must match the expectations made by your contribution.
  You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
  IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
• If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

---

Summary by cubic

Fixes ShellCheck warnings in git_push.sh by using safer empty checks and clearer messages. Updates the _common/git_push.sh.mustache template and regenerates sample scripts to apply the fix. Closes #24675.

• Bug Fixes
  • Replace [ "$var" = "" ] with [ -z "${var}" ] and keep quoted expansions.
  • Use braces in echoes and escape variable names in info logs (e.g., print ${git_host} literally).
  • Regenerate sample git_push.sh scripts across clients via ./bin/generate-samples.sh ./bin/configs/*.yaml.

^{Written for commit b71a783. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 267 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/client/petstore/java/rest-assured/git_push.sh">

<violation number="1" location="samples/client/petstore/java/rest-assured/git_push.sh:46">
P2: The rewritten remote-add line embeds GIT_TOKEN unencoded into the URL; git stores this URL verbatim in .git/config (and shows it via `git remote -v`), so the credential is persisted in plaintext on disk and push fails if the token contains URL-special characters like `@`, `:`, `/`, or `%`. Recommend not baking the token into the URL (e.g. use a credential helper/`GIT_ASKPASS`, or percent-encode the token) so the secret isn't written to the repo config.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

3 issues found across 267 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/client/petstore/ruby-autoload/git_push.sh">

<violation number="1" location="samples/client/petstore/ruby-autoload/git_push.sh:46">
P2: When GIT_TOKEN is set, its literal value is embedded in the origin URL, which `git remote add` persists in cleartext to `.git/config` and exposes via `git remote -v` after the script finishes. Additionally the token is not URL-encoded, so a token containing `@`, `/`, `#`, or `:` yields a malformed URL and `git remote add origin` fails. Keep the token out of the stored remote; add it only for the push invocation (e.g. `git push https://${git_user_id}:${GIT_TOKEN}@${git_host}/... master`) or URL-encode it.</violation>
</file>

<file name="samples/client/petstore/typescript-axios/builds/with-node-imports/git_push.sh">

<violation number="1" location="samples/client/petstore/typescript-axios/builds/with-node-imports/git_push.sh:46">
P2: The rewrite of this line leaves GIT_TOKEN interpolated raw into the git remote URL (https://${git_user_id}:${GIT_TOKEN}@...). A token value containing URL-reserved characters such as /, :, @, or + is not percent-encoded, so the remote URL is malformed and authentication fails; it also exposes the token in `ps` output, shell history, and git config. Since this line is being touched anyway, URL-encode the token (or use a credential helper) so the creds are not embedded literally in the URL.</violation>
</file>

<file name="samples/client/petstore/go/go-petstore/git_push.sh">

<violation number="1" location="samples/client/petstore/go/go-petstore/git_push.sh:13">
P2: The committed sample uses a single backslash (`Set \${git_host} to ${git_host}`), so the shell prints the literal `${git_host}` then the value, as intended. But the source template `modules/openapi-generator/src/main/resources/_common/git_push.sh.mustache` writes `Set \\${git_host} to ${git_host}` (two backslashes). In a bash double-quoted string `\\` collapses to one backslash, so regenerating with generate-samples.sh would produce `Set \github.com` — a stray backslash with the value and no literal `${git_host}`. The template and the regenerated samples are out of sync, so the next sample regeneration will silently revert the intended log-message fix. This applies to both batch files.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: When GIT_TOKEN is set, its literal value is embedded in the origin URL, which git remote add persists in cleartext to .git/config and exposes via git remote -v after the script finishes. Additionally the token is not URL-encoded, so a token containing @, /, #, or : yields a malformed URL and git remote add origin fails. Keep the token out of the stored remote; add it only for the push invocation (e.g. git push https://${git_user_id}:${GIT_TOKEN}@${git_host}/... master) or URL-encode it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/ruby-autoload/git_push.sh, line 46:

<comment>When GIT_TOKEN is set, its literal value is embedded in the origin URL, which `git remote add` persists in cleartext to `.git/config` and exposes via `git remote -v` after the script finishes. Additionally the token is not URL-encoded, so a token containing `@`, `/`, `#`, or `:` yields a malformed URL and `git remote add origin` fails. Keep the token out of the stored remote; add it only for the push invocation (e.g. `git push https://${git_user_id}:${GIT_TOKEN}@${git_host}/... master`) or URL-encode it.</comment>

<file context>
@@ -35,19 +35,16 @@ git init
+        git remote add origin "https://${git_host}/${git_user_id}/${git_repo_id}.git"
     else
-        git remote add origin https://${git_user_id}:"${GIT_TOKEN}"@${git_host}/${git_user_id}/${git_repo_id}.git
+        git remote add origin "https://${git_user_id}:${GIT_TOKEN}@${git_host}/${git_user_id}/${git_repo_id}.git"
     fi
-
</file context>

[cubic-dev-ai]

P2: The rewrite of this line leaves GIT_TOKEN interpolated raw into the git remote URL (https://${git_user_id}:${GIT_TOKEN}@...). A token value containing URL-reserved characters such as /, :, @, or + is not percent-encoded, so the remote URL is malformed and authentication fails; it also exposes the token in ps output, shell history, and git config. Since this line is being touched anyway, URL-encode the token (or use a credential helper) so the creds are not embedded literally in the URL.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/typescript-axios/builds/with-node-imports/git_push.sh, line 46:

<comment>The rewrite of this line leaves GIT_TOKEN interpolated raw into the git remote URL (https://${git_user_id}:${GIT_TOKEN}@...). A token value containing URL-reserved characters such as /, :, @, or + is not percent-encoded, so the remote URL is malformed and authentication fails; it also exposes the token in `ps` output, shell history, and git config. Since this line is being touched anyway, URL-encode the token (or use a credential helper) so the creds are not embedded literally in the URL.</comment>

<file context>
@@ -35,19 +35,16 @@ git init
+        git remote add origin "https://${git_host}/${git_user_id}/${git_repo_id}.git"
     else
-        git remote add origin https://${git_user_id}:"${GIT_TOKEN}"@${git_host}/${git_user_id}/${git_repo_id}.git
+        git remote add origin "https://${git_user_id}:${GIT_TOKEN}@${git_host}/${git_user_id}/${git_repo_id}.git"
     fi
-
</file context>

[cubic-dev-ai]

P2: The committed sample uses a single backslash (Set \${git_host} to ${git_host}), so the shell prints the literal ${git_host} then the value, as intended. But the source template modules/openapi-generator/src/main/resources/_common/git_push.sh.mustache writes Set \\${git_host} to ${git_host} (two backslashes). In a bash double-quoted string \\ collapses to one backslash, so regenerating with generate-samples.sh would produce Set \github.com — a stray backslash with the value and no literal ${git_host}. The template and the regenerated samples are out of sync, so the next sample regeneration will silently revert the intended log-message fix. This applies to both batch files.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/go/go-petstore/git_push.sh, line 13:

<comment>The committed sample uses a single backslash (`Set \${git_host} to ${git_host}`), so the shell prints the literal `${git_host}` then the value, as intended. But the source template `modules/openapi-generator/src/main/resources/_common/git_push.sh.mustache` writes `Set \\${git_host} to ${git_host}` (two backslashes). In a bash double-quoted string `\\` collapses to one backslash, so regenerating with generate-samples.sh would produce `Set \github.com` — a stray backslash with the value and no literal `${git_host}`. The template and the regenerated samples are out of sync, so the next sample regeneration will silently revert the intended log-message fix. This applies to both batch files.</comment>

<file context>
@@ -8,24 +8,24 @@ git_repo_id=$2
+if [ -z "${git_host}" ]; then
     git_host="github.com"
-    echo "[INFO] No command line input provided. Set \$git_host to $git_host"
+    echo "[INFO] No command line input provided. Set \${git_host} to ${git_host}"
 fi
 
</file context>