test(docker): Add shell tests for the docker libraries.

[jackluo923]

Description

Why

This repo has no shell tests, and neither project consuming the ca-trust library exercises it in CI — y-scope/clp-plugin-presto-connector only sources the container half on local builds, and y-scope/clp never passes a CA trust context. So a regression in this library has nowhere to be caught.

What changed

45 assertions covering expired-certificate filtering against two committed fixtures, the empty-bundle and no-bundle paths, the container export matrix, MAVEN_OPTS ordering, command assembly with values containing spaces, quotes, $, and newlines, and the stripping of credentials from image labels and build logs.

The suite runs on every CI platform, including macOS — whose /bin/bash is 3.2. That caught a real one: the libraries used bash namerefs and failed outright on macOS, which #119 now fixes. #119 was green before these tests existed, because nothing exercised it.

Two assertions are regressions for bugs found while integrating y-scope/clp: CA_TRUST_JVM being passed by reference (so a caller that scoped the assignment to the call silently lost JVM trust), and a build-arg helper leaking a nonzero status to an errexit caller when its last variable was unset.

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

task test passes.

Every assertion was checked by reintroducing the bug it guards and confirming the suite fails and exits nonzero — a test that has never been seen to fail isn't evidence of anything.

That mattered twice here, and both lessons are baked into the harness:

• Assertions run in the parent shell. An earlier version ran them inside ( … ), where the failure counter can't propagate, so the suite reported PASSED: 22/22 while silently swallowing 10 assertions.
• grep -c needs || true. It exits 1 on zero matches, which under errexit aborts the suite instead of failing the assertion — precisely when the regression is present. The CA_TRUST_JVM test hit exactly this and passed against a known-broken library until it was fixed.

A shellcheck task is deliberately not included. The lint workflow only triggers on **/*.py, **/*.pyi, and **/*.yaml, and shellcheck isn't installed in CI, so adding the task here would look like the shell libraries were linted while never actually running. Making it real means changing the workflow's path filters and installing the tool — a repo-wide policy change that should be proposed on its own, once this stack lands.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f6f43ccd-385e-4ed6-8d01-9c4c0af92e20

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}