Shell Scripting Workshop – Overview · Shell Scripting

Overview

This workshop covers the path from Bash execution fundamentals to safe, testable and operations-ready automation.

The focus is on:

Bash and POSIX-adjacent shell concepts
quoting, expansion and exit codes
files, streams, pipelines and text processing
CLI design, functions, getopts and libraries
error handling, trap, temporary files and cleanup
tests, ShellCheck, shfmt, Bats model and CI/CD
safe input, secrets, permissions, PATH and destructive operations

Quickstart

# Workshop content is provided through the Orthevs Academy.
chmod +x scripts/provision_shell_scripting.sh
./scripts/provision_shell_scripting.sh --dry-run
./examples/00-lab-skeleton/run.sh

Audience

Developers, administrators, DevOps engineers, SREs, platform engineers, security engineers and everyone who writes, reviews or operates shell scripts.

Learning Path

Level	Focus	Outcome
Fundamentals	Syntax, Ausführung, Quoting, Exit Codes, Dateien und erste sichere Skripte	You can explain, run and review the related script patterns.
Intermediate	CLI-Design, Funktionen, getopts, Textverarbeitung, Fehlerbehandlung und Cleanup	You can explain, run and review the related script patterns.
Professional	Skriptarchitektur, Tests, CI/CD, Packaging, Observability und teamfähige Standards	You can explain, run and review the related script patterns.
Advanced Security	Threat Modeling, Injection-Schutz, Secrets, Rechte, sichere Löschung und Incident Response	You can explain, run and review the related script patterns.

Structure

Workshop Structure

.
├── assessments/
├── docs/
├── examples/
├── exercises/
├── media/
├── scripts/
├── workshops/
├── LICENSE.md
└── README-EN.md

Prerequisites

Linux, macOS or WSL
Bash
Git
GNU or BSD userland with find, sed, awk, grep and mktemp
optional ShellCheck, shfmt, Bats and jq

Official Documentation

Working Mode

Do not use production paths, secrets or customer data in labs.
Run destructive patterns only with dry-run and scope checks.
Treat work/ directories as temporary evidence.
Check scripts at least with bash -n; ShellCheck and shfmt are recommended.

Sources and References

Review Checklist for the Workshop

01. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
02. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
03. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
04. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
05. separate stderr and stdout: Record the affected file, command, exit code and risk.
06. create temporary files with mktemp: Record the affected file, command, exit code and risk.
07. test cleanup through trap: Record the affected file, command, exit code and risk.
08. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
09. never print or commit secrets: Record the affected file, command, exit code and risk.
10. check PATH and external dependencies: Record the affected file, command, exit code and risk.
11. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
12. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
13. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
14. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
15. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
16. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
17. separate stderr and stdout: Record the affected file, command, exit code and risk.
18. create temporary files with mktemp: Record the affected file, command, exit code and risk.
19. test cleanup through trap: Record the affected file, command, exit code and risk.
20. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
21. never print or commit secrets: Record the affected file, command, exit code and risk.
22. check PATH and external dependencies: Record the affected file, command, exit code and risk.
23. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
24. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
25. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
26. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
27. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
28. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
29. separate stderr and stdout: Record the affected file, command, exit code and risk.
30. create temporary files with mktemp: Record the affected file, command, exit code and risk.
31. test cleanup through trap: Record the affected file, command, exit code and risk.
32. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
33. never print or commit secrets: Record the affected file, command, exit code and risk.
34. check PATH and external dependencies: Record the affected file, command, exit code and risk.
35. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
36. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.

Practice Appendix: Workshop

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with Bash, test data and a Git repository.

A001. Bash

Task: validate input and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A002. POSIX

Task: explain exit code and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A003. Testing

Task: check quoting and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A004. Security

Task: test error path and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A005. Bash

Task: review log output and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A006. POSIX

Task: trace cleanup and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A007. Testing

Task: scope portability and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A008. Security

Task: mark security risk and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A009. Bash

Task: document recovery path and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A010. POSIX

Task: write review rule and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A011. Testing

Task: validate input and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A012. Security

Task: explain exit code and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A013. Bash

Task: check quoting and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A014. POSIX

Task: test error path and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A015. Testing

Task: review log output and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A016. Security

Task: trace cleanup and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A017. Bash

Task: scope portability and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A018. POSIX

Task: mark security risk and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A019. Testing

Task: document recovery path and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A020. Security

Task: write review rule and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A021. Bash

Task: validate input and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A022. POSIX

Task: explain exit code and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A023. Testing

Task: check quoting and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A024. Security

Task: test error path and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A025. Bash

Task: review log output and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A026. POSIX

Task: trace cleanup and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A027. Testing

Task: scope portability and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A028. Security

Task: mark security risk and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A029. Bash

Task: document recovery path and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A030. POSIX

Task: write review rule and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A031. Testing

Task: validate input and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A032. Security

Task: explain exit code and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A033. Bash

Task: check quoting and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A034. POSIX

Task: test error path and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A035. Testing

Task: review log output and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A036. Security

Task: trace cleanup and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A037. Bash

Task: scope portability and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A038. POSIX

Task: mark security risk and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A039. Testing

Task: document recovery path and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A040. Security

Task: write review rule and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A041. Bash

Task: validate input and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A042. POSIX

Task: explain exit code and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A043. Testing

Task: check quoting and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A044. Security

Task: test error path and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A045. Bash

Task: review log output and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A046. POSIX

Task: trace cleanup and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A047. Testing

Task: scope portability and connect the observation explicitly to Testing.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A048. Security

Task: mark security risk and connect the observation explicitly to Security.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A049. Bash

Task: document recovery path and connect the observation explicitly to Bash.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A050. POSIX

Task: write review rule and connect the observation explicitly to POSIX.
Evidence: Record the checked command, expected output, actual output and exit code.
Operations question: What happens with empty input, missing files, missing tools and repeated execution?
Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.