more secure defer using SafeCloseDeferCallback

Author: François Chastanet

.github/workflows/main.yml

@@ -64,7 +64,7 @@ jobs:
 
       - uses: akatov/commit-status-updater@a9e988ec5454692ff7745a509452422a35172ad6
         with:
-          name: docker-build-${{ env.image_tag }}
+          name: build-docker-${{ env.image_tag }}
           status: pending
 
       - name: Docker meta
@@ -101,7 +101,12 @@ jobs:
       - uses: akatov/commit-status-updater@a9e988ec5454692ff7745a509452422a35172ad6
         if: ${{ always() }}
         with:
-          name: docker-build-${{ env.image_tag }}
+          name: build-docker-${{ env.image_tag }}
+          status: ${{ job.status }}
+
+      - uses: akatov/commit-status-updater@a9e988ec5454692ff7745a509452422a35172ad6
+        with:
+          name: build-docker
           status: ${{ job.status }}
 
   # -------------------------------------------------------

internal/compiler/annotationEmbedGenerate.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/fchastanet/bash-compiler/internal/render"
 	"github.com/fchastanet/bash-compiler/internal/utils/encoding"
+	"github.com/fchastanet/bash-compiler/internal/utils/errors"
 	"github.com/fchastanet/bash-compiler/internal/utils/files"
 	"github.com/fchastanet/bash-compiler/internal/utils/logger"
 	"github.com/fchastanet/bash-compiler/internal/utils/tar"
@@ -70,8 +71,7 @@ func (annotationEmbedGenerate *annotationEmbedGenerate) renderFile(
 	if logger.FancyHandleError(err) {
 		return "", err
 	}
-	// skipcq: GO-S2307 // no need Sync as readOnly open
-	defer file.Close()
+	defer errors.SafeCloseDeferCallback(file, &err)
 
 	md5sum, err := encoding.ChecksumFromFile(file)
 	if logger.FancyHandleError(err) {
@@ -111,7 +111,7 @@ func (annotationEmbedGenerate *annotationEmbedGenerate) renderDir(
 	if logger.FancyHandleError(err) {
 		return "", err
 	}
-	defer directoryArchive.Close()
+	defer errors.SafeCloseDeferCallback(directoryArchive, &err)
 	err = directoryArchive.Sync()
 	if err != nil {
 		return "", err

internal/utils/dotenv/LoadEnvFile.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/a8m/envsubst"
+	"github.com/fchastanet/bash-compiler/internal/utils/errors"
 	"github.com/fchastanet/bash-compiler/internal/utils/logger"
 )
 
@@ -21,8 +22,7 @@ func LoadEnvFile(confFile string) error {
 	if err != nil {
 		return err
 	}
-	// skipcq: GO-S2307 // no need Sync as readOnly open
-	defer confFileContent.Close()
+	defer errors.SafeCloseDeferCallback(confFileContent, &err)
 
 	variables := make(map[string]string)
 	scanFile(confFileContent, variables)

internal/utils/dotenv/LoadEnvFile_test.go

@@ -54,7 +54,7 @@ func TestLoadFileDependentVarsDefaultValues(t *testing.T) {
 	defer teardownTest(t)
 	err := LoadEnvFile("./testsData/dependentVars.txt")
 	assert.NilError(t, err, "error should be nil")
-	envValue, exists := os.LookupEnv("FRAMEWORK_ROOT_DIR")
+	envValue, exists := os.LookupEnv("CUSTOM_ENV_VAR")
 	assert.Equal(t, exists, true)
 	assert.Equal(t, envValue, "dummy", envValue)
 	envValue, exists = os.LookupEnv("SRC_FILE")

internal/utils/dotenv/testsData/dependentVars.txt

@@ -1,2 +1,2 @@
-FRAMEWORK_ROOT_DIR=${MY_VAR:-dummy}
-SRC_FILE="${FRAMEWORK_ROOT_DIR}/srcFile"
+CUSTOM_ENV_VAR=${MY_VAR:-dummy}
+SRC_FILE="${CUSTOM_ENV_VAR}/srcFile"

internal/utils/encoding/checksum_test.go

@@ -30,6 +30,7 @@ func TestChecksumFromFile(t *testing.T) {
 	)
 }
 
+// jscpd:ignore-start
 func TestChecksumFromUnknownFile(t *testing.T) {
 	tempFile, _ := os.CreateTemp("", "test******")
 	tempFile.Sync()
@@ -40,3 +41,5 @@ func TestChecksumFromUnknownFile(t *testing.T) {
 	assert.IsType(t, &fs.PathError{Op: "", Path: "", Err: nil}, err)
 	assert.Equal(t, "", checksum)
 }
+
+// jscpd:ignore-end

internal/utils/errors/errors.go

@@ -1,6 +1,8 @@
 package errors
 
-import "fmt"
+import (
+	"fmt"
+)
 
 type ValidationError struct {
 	InnerError error
@@ -15,3 +17,15 @@ func (e *ValidationError) Error() string {
 		e.Context, e.FieldName, e.FieldValue,
 	)
 }
+
+type closeInterface interface {
+	Close() error
+}
+
+func SafeCloseDeferCallback(file closeInterface, err *error) {
+	// Report the error, if any, from Close, but do so
+	// only if there isn't already an outgoing error.
+	if c := file.Close(); *err == nil {
+		*err = c
+	}
+}

internal/utils/files/files.go

@@ -7,6 +7,8 @@ import (
 	"errors"
 	"io"
 	"os"
+
+	myErrors "github.com/fchastanet/bash-compiler/internal/utils/errors"
 )
 
 const (
@@ -90,21 +92,14 @@ func Copy(srcPath string, dstPath string) (err error) {
 	if err != nil {
 		return err
 	}
-	// skipcq: GO-S2307 // no need Sync as readOnly open
-	defer r.Close() // ignore error: file was opened read-only.
+	defer myErrors.SafeCloseDeferCallback(r, &err)
 
 	w, err := os.Create(dstPath)
 	if err != nil {
 		return err
 	}
 
-	defer func() {
-		// Report the error, if any, from Close, but do so
-		// only if there isn't already an outgoing error.
-		if c := w.Close(); err == nil {
-			err = c
-		}
-	}()
+	defer myErrors.SafeCloseDeferCallback(w, &err)
 
 	_, err = io.Copy(w, r)
 	return err

internal/utils/tar/tar.go

@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/fchastanet/bash-compiler/internal/utils/errors"
 	"github.com/fchastanet/bash-compiler/internal/utils/logger"
 )
 
@@ -17,15 +18,15 @@ func CreateArchive(
 	relativeDir string,
 	buf io.Writer,
 	updateFileInfoHeader func(info *tar.Header, fi fs.FileInfo) error,
-) error {
+) (err error) {
 	// Create new Writers for gzip and tar
 	// These writers are chained. Writing to the tar writer will
 	// write to the gzip writer which in turn will write to
 	// the "buf" writer
 	gw := gzip.NewWriter(buf)
-	defer gw.Close()
+	defer errors.SafeCloseDeferCallback(gw, &err)
 	tw := tar.NewWriter(gw)
-	defer tw.Close()
+	defer errors.SafeCloseDeferCallback(tw, &err)
 
 	// Iterate over files and add them to the tar archive
 	for _, file := range files {
@@ -97,8 +98,7 @@ func addToArchive(
 	if err != nil {
 		return err
 	}
-	// skipcq: GO-S2307 // no need Sync as readOnly open
-	defer file.Close()
+	defer errors.SafeCloseDeferCallback(file, &err)
 
 	header, err := getFileHeader(fileInfo, filename, relativeDir)
 	if err != nil {