From 19e9a4e44bf519c6ab880a07fcb2cdcdd6d40c3a Mon Sep 17 00:00:00 2001
From: Arun Kushwaha <121769639+Arun-kushwaha007@users.noreply.github.com>
Date: Wed, 21 Jan 2026 23:23:52 +0530
Subject: [PATCH] tooling: Enable strict shell mode in selected scripts.

Add strict shell options (set -euo pipefail / set -eu) to a small
set of simple shell scripts that do not rely on unset variables
or pipeline exit-code masking.

Each script was reviewed line by line to confirm strict mode is
safe and that stopping immediately on errors is the correct
behavior for these scripts.

Fixes part of #20748.
---
 puppet/zulip/files/letsencrypt/020-symlink.sh | 2 +-
 puppet/zulip/files/letsencrypt/050-nginx.sh   | 2 +-
 tools/run-tsc                                 | 1 +
 tools/setup-git-repo                          | 1 +
 4 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/puppet/zulip/files/letsencrypt/020-symlink.sh b/puppet/zulip/files/letsencrypt/020-symlink.sh
index 8a46afe7ca..9b0794b53c 100755
--- a/puppet/zulip/files/letsencrypt/020-symlink.sh
+++ b/puppet/zulip/files/letsencrypt/020-symlink.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-
+set -euo pipefail
 symlink_with_backup() {
     if [ -e "$2" ]; then
         # If the user is setting up our automatic certbot-management on a
diff --git a/puppet/zulip/files/letsencrypt/050-nginx.sh b/puppet/zulip/files/letsencrypt/050-nginx.sh
index cf117c0523..4f3c30d9a1 100755
--- a/puppet/zulip/files/letsencrypt/050-nginx.sh
+++ b/puppet/zulip/files/letsencrypt/050-nginx.sh
@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
-
+set -euo pipefail
 service nginx reload
diff --git a/tools/run-tsc b/tools/run-tsc
index 8d0f6d5bcb..8644df6c2f 100755
--- a/tools/run-tsc
+++ b/tools/run-tsc
@@ -1,3 +1,4 @@
 #!/bin/sh
+set -eu
 ZULIP_PATH="$(dirname "$0")/.."
 exec "$ZULIP_PATH/node_modules/.bin/tsc" --project "$ZULIP_PATH" "$@"
diff --git a/tools/setup-git-repo b/tools/setup-git-repo
index 7493d14106..e0dfe40286 100755
--- a/tools/setup-git-repo
+++ b/tools/setup-git-repo
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+set -euo pipefail
 
 if ! [ -d ".git/hooks/" ]; then
     echo "Error: Could not find .git/hooks directory"