Merge pull request #14 from GoodOlClint/copilot/sub-pr-13

fix: harden run-integration.sh against special chars, token leakage, and ARM

tests/Dockerfile.test

@@ -20,7 +20,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         curl jq openssh-client ca-certificates apt-transport-https gnupg \
     && curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \
        | gpg --dearmor -o /usr/share/keyrings/microsoft-archive-keyring.gpg \
-    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] \
        https://packages.microsoft.com/ubuntu/24.04/prod noble main" \
        > /etc/apt/sources.list.d/microsoft-prod.list \
     && apt-get update && apt-get install -y --no-install-recommends powershell \

tests/dev.sh

@@ -40,7 +40,7 @@ build_module() {
         dotnet publish src/PSProxmoxVE/PSProxmoxVE.csproj \
             -c Release -f netstandard2.0 -o /tmp/publish 2>&1 | tail -1 && \
         cp -r /tmp/publish/* $MODULE_PATH/ && \
-        echo 'Module installed to $MODULE_PATH'
+        echo "Module installed to $MODULE_PATH"
     "
 }
 

tests/infrastructure/scripts/run-integration.sh

@@ -99,7 +99,9 @@ cmd_provision() {
 
     # Generate answer file
     log "Generating answer file..."
-    sed "s/\${root_password}/${PVE_PASSWORD}/" \
+    local escaped_pve_password
+    escaped_pve_password=$(printf '%s' "$PVE_PASSWORD" | sed 's/[\/&\\]/\\&/g')
+    sed "s/\${root_password}/${escaped_pve_password}/" \
         "$INFRA_DIR/answer.toml.tftpl" > "$WORK_DIR/answer.toml"
 
     # Prepare auto-install ISOs
@@ -121,17 +123,24 @@ cmd_provision() {
 
     log "Building Terraform vars..."
     local tfvars="$WORK_DIR/instances.tfvars.json"
-    local instances="{"
-    local first=true
+    local instances='{}'
     for v in $PVE_VERSIONS; do
         local iso_name
         iso_name="$(pve_iso "$v")"
-        $first || instances+=","
-        first=false
-        instances+="\"pve${v}\":{\"iso_local_path\":\"$WORK_DIR/${iso_name%.iso}-auto.iso\",\"vm_id\":$(pve_vmid "$v"),\"vm_name\":\"$(pve_vmname "$v")\"}"
+        local iso_path="$WORK_DIR/${iso_name%.iso}-auto.iso"
+        local vm_id
+        vm_id="$(pve_vmid "$v")"
+        local vm_name
+        vm_name="$(pve_vmname "$v")"
+        instances="$(jq \
+            --arg key "pve${v}" \
+            --arg iso_local_path "$iso_path" \
+            --arg vm_name "$vm_name" \
+            --argjson vm_id "$vm_id" \
+            '. + {($key): {iso_local_path: $iso_local_path, vm_id: $vm_id, vm_name: $vm_name}}' \
+            <<<"$instances")"
     done
-    instances+="}"
-    echo "{\"pve_instances\":$instances}" > "$tfvars"
+    jq -n --argjson pve_instances "$instances" '{pve_instances: $pve_instances}' > "$tfvars"
 
     log "Running Terraform apply..."
     (cd "$INFRA_DIR" && \
@@ -182,8 +191,7 @@ cmd_provision() {
     jq_expr+=", cloud_image_path: \$cloud_image, ova_path: \$ova}"
 
     jq -n "${jq_args[@]}" "$jq_expr" > "$CONFIG_FILE"
-    log "Test config:"
-    jq . "$CONFIG_FILE"
+    log "Test config written to $CONFIG_FILE"
     log "Provisioning complete."
 }
 
@@ -249,7 +257,7 @@ cmd_test() {
 
         export PVETEST_ISO_PATH="$iso_path"
         export PVETEST_PVE_VERSION="$v"
-        export PVETEST_PASSWORD="${PVE_PASSWORD:-}"
+        export PVETEST_PASSWORD="${PVETEST_PASSWORD:-${PVE_PASSWORD:-}}"
 
         # Verify API reachable
         log "Verifying PVE $v API at $PVETEST_HOST:$PVETEST_PORT..."