From 45bba1efe6f0b1d1c052f71b2053ce30c7b32e5d Mon Sep 17 00:00:00 2001
From: rhdh-bot <rhdh-bot@redhat.com>
Date: Tue, 7 Jul 2026 15:34:42 -0300
Subject: [PATCH 1/4] fix: harden shell scripts and fix db_copy loop bug

Correct a logic error in hack/db_copy.sh that caused every database
migration to target backstage_plugin_app, and apply shellcheck-driven
hardening across plugin-infra setup scripts and Tekton inline scripts.

Assisted-by: cursor
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 config/profile/rhdh/plugin-deps/tekton.yaml   | 19 ++++--
 .../rhdh/plugin-infra/gitops-secret-setup.sh  | 60 ++++++++++---------
 .../profile/rhdh/plugin-infra/plugin-infra.sh | 10 ++--
 hack/db_copy.sh                               |  3 +-
 4 files changed, 52 insertions(+), 40 deletions(-)

diff --git a/config/profile/rhdh/plugin-deps/tekton.yaml b/config/profile/rhdh/plugin-deps/tekton.yaml
index 653dc95af..e09a56430 100644
--- a/config/profile/rhdh/plugin-deps/tekton.yaml
+++ b/config/profile/rhdh/plugin-deps/tekton.yaml
@@ -174,8 +174,9 @@ spec:
       image: registry.access.redhat.com/ubi9-minimal
       workingDir: $(workspaces.workflow-source.path)
       script: |
-        ROOT=/workspace/workflow
-        TARGET=flat
+        #!/usr/bin/env sh
+        set -eu
+
         mkdir -p flat
 
         if [ -d "workflow/$(params.workflowId)" ]; then
@@ -186,7 +187,7 @@ spec:
           cp workflow/LICENSE flat/$(params.workflowId)
         fi
 
-        if [ "$(params.convertToFlat)" == "false" ]; then
+        if [ "$(params.convertToFlat)" = "false" ]; then
           rm -rf workflow/src/main/resources
           mv workflow/src flat/$(params.workflowId)/
         fi
@@ -212,6 +213,9 @@ spec:
       image: registry.access.redhat.com/ubi9-minimal
       workingDir: $(workspaces.workflow-source.path)/flat/$(params.workflowId)
       script: |
+        #!/usr/bin/env sh
+        set -eu
+
         microdnf install -y tar gzip
         KN_CLI_URL="https://developers.redhat.com/content-gateway/file/pub/cgw/serverless-logic/1.38.0/kn-workflow-linux-amd64.tar.gz"
         curl -L "$KN_CLI_URL" | tar -xz --no-same-owner && chmod +x kn-workflow-linux-amd64 && mv kn-workflow-linux-amd64 kn-workflow
@@ -237,10 +241,13 @@ spec:
       image: registry.access.redhat.com/ubi9-minimal
       workingDir: $(workspaces.workflow-gitops.path)/workflow-gitops
       script: |
-        cp $(workspaces.workflow-source.path)/flat/$(params.workflowId)/manifests/* kustomize/base
+        #!/usr/bin/env sh
+        set -eu
+
+        cp "$(workspaces.workflow-source.path)/flat/$(params.workflowId)/manifests/"* kustomize/base
         microdnf install -y findutils && microdnf clean all
-        cd kustomize
-        ./updater.sh $(params.workflowId) $(params.imageTag)
+        cd kustomize || exit
+        ./updater.sh "$(params.workflowId)" "$(params.imageTag)"
 ---
 apiVersion: tekton.dev/v1
 kind: Pipeline
diff --git a/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh b/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh
index a95bbf54c..058dcf603 100644
--- a/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh
+++ b/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh
@@ -3,9 +3,13 @@
 # Setup Script for RHDH Authentication For Orchestrator CICD
 #
 
-function captureRHDHNamespace {
+set -euo pipefail
+
+selected_instance=""
+
+captureRHDHNamespace() {
   default="rhdh"
-  if [ "$use_default" == true ]; then
+  if [[ "$use_default" == true ]]; then
     rhdh_workspace="$default"
   else
     read -rp "Enter RHDH Instance namespace (default: $default): " value
@@ -18,9 +22,9 @@ function captureRHDHNamespace {
   RHDH_NAMESPACE=$rhdh_workspace
 }
 
-function captureArgoCDNamespace {
+captureArgoCDNamespace() {
   default="openshift-gitops-operator"
-  if [ "$use_default" == true ]; then
+  if [[ "$use_default" == true ]]; then
     argocd_namespace="$default"
   else
     read -rp "Enter ArgoCD installation namespace (default: $default): " value
@@ -34,13 +38,13 @@ function captureArgoCDNamespace {
   ARGOCD_NAMESPACE=$argocd_namespace
 }
 
-function captureArgoCDURL {
+captureArgoCDURL() {
   argocd_instances=$(oc get argocd -n "$ARGOCD_NAMESPACE" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')
 
   if [ -z "$argocd_instances" ]; then
       echo "No ArgoCD instances found in namespace $ARGOCD_NAMESPACE. Continuing without ArgoCD support"
   else
-    if [ "$use_default" == true ]; then
+    if [[ "$use_default" == true ]]; then
           selected_instance=$(echo "$argocd_instances" | awk 'NR==1')
           echo "Select an ArgoCD instance: $selected_instance"
     else
@@ -56,12 +60,12 @@ function captureArgoCDURL {
     fi
     argocd_route=$(oc get route -n "$ARGOCD_NAMESPACE" -l app.kubernetes.io/managed-by="$selected_instance" -ojsonpath='{.items[0].status.ingress[0].host}')
     echo "Found Route at $argocd_route"
-    ARGOCD_URL=https://$argocd_route
+    ARGOCD_URL="https://${argocd_route}"
   fi
 
 }
 
-function captureArgoCDCreds {
+captureArgoCDCreds() {
   if [ -n "$selected_instance" ]; then
     admin_password=$(oc get secret -n "$ARGOCD_NAMESPACE" "${selected_instance}"-cluster -ojsonpath='{.data.admin\.password}' | base64 -d)
     ARGOCD_USERNAME="admin"
@@ -69,8 +73,8 @@ function captureArgoCDCreds {
   fi
 }
 
-function captureGitToken {
-   if [ -z "$GITHUB_TOKEN" ]; then
+captureGitToken() {
+   if [ -z "${GITHUB_TOKEN:-}" ]; then
     read -rs -p "Enter GitHub access token: " value
     echo ""
     GITHUB_TOKEN=$value
@@ -79,15 +83,15 @@ function captureGitToken {
   fi
 }
 
-function captureK8sURL {
+captureK8sURL() {
   url="$(oc whoami --show-server)"
   K8S_CLUSTER_URL=$url
 }
 
-function  generateK8sToken {
+generateK8sToken() {
   sa_namespace="rhdh"
   sa_name="rhdh"
-  if [ "$use_default" == false ]; then
+  if [[ "$use_default" == false ]]; then
     read -rp "Which namespace should be used or created to check the SA holding the persistent token? (default: $sa_namespace): " selected_namespace
     if [ -n "$selected_namespace" ]; then
       sa_namespace="$selected_namespace"
@@ -129,42 +133,44 @@ EOF
   K8S_CLUSTER_TOKEN=$(oc -n "$sa_namespace" get secret/"${sa_name}" -o jsonpath='{.data.token}' | base64 -d )
 }
 
-
-function checkPrerequisite {
+checkPrerequisite() {
   if ! command -v oc &> /dev/null; then
     echo "oc is required for this script to run. Exiting."
     exit 1
   fi
 }
 
-function createBackstageSecret {
+createBackstageSecret() {
   if 2>/dev/null 1>&2 oc get secret backstage-backend-auth-secret -n "$RHDH_NAMESPACE"; then
     oc delete secret backstage-backend-auth-secret -n "$RHDH_NAMESPACE"
   fi
   declare -A secretKeys
-  if [ -n "$K8S_CLUSTER_URL" ]; then
+  if [ -n "${K8S_CLUSTER_URL:-}" ]; then
     secretKeys[K8S_CLUSTER_URL]=$K8S_CLUSTER_URL
   fi
-  if [ -n "$K8S_CLUSTER_TOKEN" ]; then
+  if [ -n "${K8S_CLUSTER_TOKEN:-}" ]; then
     secretKeys[K8S_CLUSTER_TOKEN]=$K8S_CLUSTER_TOKEN
   fi
-  if [ -n "$ARGOCD_USERNAME" ]; then
+  if [ -n "${ARGOCD_USERNAME:-}" ]; then
     secretKeys[ARGOCD_USERNAME]=$ARGOCD_USERNAME
   fi
-  if [ -n "$ARGOCD_URL" ]; then
+  if [ -n "${ARGOCD_URL:-}" ]; then
     secretKeys[ARGOCD_URL]=$ARGOCD_URL
   fi
-  if [ -n "$ARGOCD_PASSWORD" ]; then
+  if [ -n "${ARGOCD_PASSWORD:-}" ]; then
     secretKeys[ARGOCD_PASSWORD]=$ARGOCD_PASSWORD
   fi
-  if [ -n "$GITHUB_TOKEN" ]; then
+  if [ -n "${GITHUB_TOKEN:-}" ]; then
     secretKeys[GITHUB_TOKEN]=$GITHUB_TOKEN
   fi
-  cmd="oc create secret generic backstage-backend-auth-secret -n $RHDH_NAMESPACE"
+  local -a cmd=(
+    oc create secret generic backstage-backend-auth-secret
+    -n "$RHDH_NAMESPACE"
+  )
   for key in "${!secretKeys[@]}"; do
-    cmd="${cmd} --from-literal=${key}=${secretKeys[$key]}"
+    cmd+=(--from-literal="${key}=${secretKeys[$key]}")
   done
-  eval "$cmd"
+  "${cmd[@]}"
 }
 
 # Function to display usage instructions
@@ -196,7 +202,7 @@ while [[ $# -gt 0 ]]; do
     shift
 done
 
-function main {
+main() {
 
   # Check if using default values or not
   if $use_default; then
@@ -218,4 +224,4 @@ function main {
   echo "Setup completed successfully!"
 }
 
-main
\ No newline at end of file
+main
diff --git a/config/profile/rhdh/plugin-infra/plugin-infra.sh b/config/profile/rhdh/plugin-infra/plugin-infra.sh
index 7d1a00fed..bf63419f5 100755
--- a/config/profile/rhdh/plugin-infra/plugin-infra.sh
+++ b/config/profile/rhdh/plugin-infra/plugin-infra.sh
@@ -3,7 +3,7 @@
 # Plugin Infrastructure Setup Script for RHDH with Orchestrator
 #
 
-set -e
+set -euo pipefail
 
 action="apply" # Default action
 branch="main"  # Default branch
@@ -47,24 +47,24 @@ apply_manifest() {
 }
 
 # Execution
-if [ "$action" == "apply" ]; then
+if [[ "$action" == "apply" ]]; then
   apply_manifest "serverless.yaml"
   echo "Waiting for CRDs to be established..."
   kubectl wait --for=condition=Established crd --all --timeout=60s
   apply_manifest "knative.yaml"
   apply_manifest "serverless-logic.yaml"
-  if [ "$cicd" == true ]; then
+  if [[ "$cicd" == true ]]; then
     echo "CICD enabled. Executing CICD-specific logic..."
     apply_manifest "argocd.yaml"
     kubectl wait --for=condition=Established crd --all --timeout=60s
     apply_manifest "argocd-cr.yaml"
     apply_manifest "pipeline.yaml"
   fi
-elif [ "$action" == "delete" ]; then
+elif [[ "$action" == "delete" ]]; then
   apply_manifest "serverless-logic.yaml"
   apply_manifest "knative.yaml"
   apply_manifest "serverless.yaml"
-  if [ "$cicd" == true ]; then
+  if [[ "$cicd" == true ]]; then
     apply_manifest "argocd.yaml"
     apply_manifest "argocd-cr.yaml"
     apply_manifest "pipeline.yaml"
diff --git a/hack/db_copy.sh b/hack/db_copy.sh
index afc174017..38cd88cbb 100644
--- a/hack/db_copy.sh
+++ b/hack/db_copy.sh
@@ -15,8 +15,7 @@ from_user=postgres
 allDB=("backstage_plugin_app" "backstage_plugin_auth" "backstage_plugin_catalog" "backstage_plugin_permission" "backstage_plugin_scaffolder" "backstage_plugin_search")
 
 for db in "${allDB[@]}"; do
-  db=${allDB["$db"]}
-  echo Copying database: "$db"
+  echo "Copying database: $db"
   PGPASSWORD="$TO_PSW" psql -h "$to_host" -p "$to_port" -U "$to_user" -c "create database \"$db\";"
   pg_dump -h "$from_host" -p "$from_port" -U "$from_user" -d "$db" | PGPASSWORD="$TO_PSW" psql -h "$to_host" -p "$to_port" -U "$to_user" -d "$db"
 done
\ No newline at end of file

From 7d87ff06fd435f308cd650043f4ace80105c2dfb Mon Sep 17 00:00:00 2001
From: rhdh-bot <rhdh-bot@redhat.com>
Date: Tue, 7 Jul 2026 15:44:31 -0300
Subject: [PATCH 2/4] fix: rename gitops-secret-setup functions to snake_case

Address SonarCloud warnings about camelCase function names introduced
during shell script hardening.

Assisted-by: cursor
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../rhdh/plugin-infra/gitops-secret-setup.sh  | 36 +++++++++----------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh b/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh
index 058dcf603..6c38d43f3 100644
--- a/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh
+++ b/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh
@@ -7,7 +7,7 @@ set -euo pipefail
 
 selected_instance=""
 
-captureRHDHNamespace() {
+capture_rhdh_namespace() {
   default="rhdh"
   if [[ "$use_default" == true ]]; then
     rhdh_workspace="$default"
@@ -22,7 +22,7 @@ captureRHDHNamespace() {
   RHDH_NAMESPACE=$rhdh_workspace
 }
 
-captureArgoCDNamespace() {
+capture_argocd_namespace() {
   default="openshift-gitops-operator"
   if [[ "$use_default" == true ]]; then
     argocd_namespace="$default"
@@ -38,7 +38,7 @@ captureArgoCDNamespace() {
   ARGOCD_NAMESPACE=$argocd_namespace
 }
 
-captureArgoCDURL() {
+capture_argocd_url() {
   argocd_instances=$(oc get argocd -n "$ARGOCD_NAMESPACE" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')
 
   if [ -z "$argocd_instances" ]; then
@@ -65,7 +65,7 @@ captureArgoCDURL() {
 
 }
 
-captureArgoCDCreds() {
+capture_argocd_creds() {
   if [ -n "$selected_instance" ]; then
     admin_password=$(oc get secret -n "$ARGOCD_NAMESPACE" "${selected_instance}"-cluster -ojsonpath='{.data.admin\.password}' | base64 -d)
     ARGOCD_USERNAME="admin"
@@ -73,7 +73,7 @@ captureArgoCDCreds() {
   fi
 }
 
-captureGitToken() {
+capture_git_token() {
    if [ -z "${GITHUB_TOKEN:-}" ]; then
     read -rs -p "Enter GitHub access token: " value
     echo ""
@@ -83,12 +83,12 @@ captureGitToken() {
   fi
 }
 
-captureK8sURL() {
+capture_k8s_url() {
   url="$(oc whoami --show-server)"
   K8S_CLUSTER_URL=$url
 }
 
-generateK8sToken() {
+generate_k8s_token() {
   sa_namespace="rhdh"
   sa_name="rhdh"
   if [[ "$use_default" == false ]]; then
@@ -133,14 +133,14 @@ EOF
   K8S_CLUSTER_TOKEN=$(oc -n "$sa_namespace" get secret/"${sa_name}" -o jsonpath='{.data.token}' | base64 -d )
 }
 
-checkPrerequisite() {
+check_prerequisite() {
   if ! command -v oc &> /dev/null; then
     echo "oc is required for this script to run. Exiting."
     exit 1
   fi
 }
 
-createBackstageSecret() {
+create_backstage_secret() {
   if 2>/dev/null 1>&2 oc get secret backstage-backend-auth-secret -n "$RHDH_NAMESPACE"; then
     oc delete secret backstage-backend-auth-secret -n "$RHDH_NAMESPACE"
   fi
@@ -211,15 +211,15 @@ main() {
       echo "Not using default values."
   fi
 
-  checkPrerequisite
-  captureK8sURL
-  generateK8sToken
-  captureRHDHNamespace
-  captureArgoCDNamespace
-  captureArgoCDURL
-  captureArgoCDCreds
-  captureGitToken
-  createBackstageSecret
+  check_prerequisite
+  capture_k8s_url
+  generate_k8s_token
+  capture_rhdh_namespace
+  capture_argocd_namespace
+  capture_argocd_url
+  capture_argocd_creds
+  capture_git_token
+  create_backstage_secret
 
   echo "Setup completed successfully!"
 }

From acb4cd81921be4ff5ceb0d1d1ce2a0ab51ed4b4d Mon Sep 17 00:00:00 2001
From: rhdh-bot <rhdh-bot@redhat.com>
Date: Tue, 7 Jul 2026 15:45:20 -0300
Subject: [PATCH 3/4] fix: resolve SonarCloud shell script findings

Use snake_case function names and bash [[ ]] conditionals throughout
gitops-secret-setup.sh; align plugin-infra.sh file test with [[ ]].

Assisted-by: cursor
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../rhdh/plugin-infra/gitops-secret-setup.sh  | 28 +++++++++----------
 .../profile/rhdh/plugin-infra/plugin-infra.sh |  2 +-
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh b/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh
index 6c38d43f3..b829c152f 100644
--- a/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh
+++ b/config/profile/rhdh/plugin-infra/gitops-secret-setup.sh
@@ -13,7 +13,7 @@ capture_rhdh_namespace() {
     rhdh_workspace="$default"
   else
     read -rp "Enter RHDH Instance namespace (default: $default): " value
-    if [ -z "$value" ]; then
+    if [[ -z "$value" ]]; then
         rhdh_workspace="$default"
     else
         rhdh_workspace="$value"
@@ -29,7 +29,7 @@ capture_argocd_namespace() {
   else
     read -rp "Enter ArgoCD installation namespace (default: $default): " value
 
-    if [ -z "$value" ]; then
+    if [[ -z "$value" ]]; then
         argocd_namespace="$default"
     else
         argocd_namespace="$value"
@@ -41,7 +41,7 @@ capture_argocd_namespace() {
 capture_argocd_url() {
   argocd_instances=$(oc get argocd -n "$ARGOCD_NAMESPACE" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')
 
-  if [ -z "$argocd_instances" ]; then
+  if [[ -z "$argocd_instances" ]]; then
       echo "No ArgoCD instances found in namespace $ARGOCD_NAMESPACE. Continuing without ArgoCD support"
   else
     if [[ "$use_default" == true ]]; then
@@ -50,7 +50,7 @@ capture_argocd_url() {
     else
       echo "Select an ArgoCD instance:"
       select instance in $argocd_instances; do
-          if [ -n "$instance" ]; then
+          if [[ -n "$instance" ]]; then
               selected_instance="$instance"
               break
           else
@@ -66,7 +66,7 @@ capture_argocd_url() {
 }
 
 capture_argocd_creds() {
-  if [ -n "$selected_instance" ]; then
+  if [[ -n "$selected_instance" ]]; then
     admin_password=$(oc get secret -n "$ARGOCD_NAMESPACE" "${selected_instance}"-cluster -ojsonpath='{.data.admin\.password}' | base64 -d)
     ARGOCD_USERNAME="admin"
     ARGOCD_PASSWORD=$admin_password
@@ -74,7 +74,7 @@ capture_argocd_creds() {
 }
 
 capture_git_token() {
-   if [ -z "${GITHUB_TOKEN:-}" ]; then
+  if [[ -z "${GITHUB_TOKEN:-}" ]]; then
     read -rs -p "Enter GitHub access token: " value
     echo ""
     GITHUB_TOKEN=$value
@@ -93,12 +93,12 @@ generate_k8s_token() {
   sa_name="rhdh"
   if [[ "$use_default" == false ]]; then
     read -rp "Which namespace should be used or created to check the SA holding the persistent token? (default: $sa_namespace): " selected_namespace
-    if [ -n "$selected_namespace" ]; then
+    if [[ -n "$selected_namespace" ]]; then
       sa_namespace="$selected_namespace"
     fi
 
     read -rp "What is the name of the SA? (default: $sa_name): " selected_name
-    if [ -n "$selected_name" ]; then
+    if [[ -n "$selected_name" ]]; then
       sa_name="$selected_name"
     fi
   fi
@@ -145,22 +145,22 @@ create_backstage_secret() {
     oc delete secret backstage-backend-auth-secret -n "$RHDH_NAMESPACE"
   fi
   declare -A secretKeys
-  if [ -n "${K8S_CLUSTER_URL:-}" ]; then
+  if [[ -n "${K8S_CLUSTER_URL:-}" ]]; then
     secretKeys[K8S_CLUSTER_URL]=$K8S_CLUSTER_URL
   fi
-  if [ -n "${K8S_CLUSTER_TOKEN:-}" ]; then
+  if [[ -n "${K8S_CLUSTER_TOKEN:-}" ]]; then
     secretKeys[K8S_CLUSTER_TOKEN]=$K8S_CLUSTER_TOKEN
   fi
-  if [ -n "${ARGOCD_USERNAME:-}" ]; then
+  if [[ -n "${ARGOCD_USERNAME:-}" ]]; then
     secretKeys[ARGOCD_USERNAME]=$ARGOCD_USERNAME
   fi
-  if [ -n "${ARGOCD_URL:-}" ]; then
+  if [[ -n "${ARGOCD_URL:-}" ]]; then
     secretKeys[ARGOCD_URL]=$ARGOCD_URL
   fi
-  if [ -n "${ARGOCD_PASSWORD:-}" ]; then
+  if [[ -n "${ARGOCD_PASSWORD:-}" ]]; then
     secretKeys[ARGOCD_PASSWORD]=$ARGOCD_PASSWORD
   fi
-  if [ -n "${GITHUB_TOKEN:-}" ]; then
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
     secretKeys[GITHUB_TOKEN]=$GITHUB_TOKEN
   fi
   local -a cmd=(
diff --git a/config/profile/rhdh/plugin-infra/plugin-infra.sh b/config/profile/rhdh/plugin-infra/plugin-infra.sh
index bf63419f5..88cb694a4 100755
--- a/config/profile/rhdh/plugin-infra/plugin-infra.sh
+++ b/config/profile/rhdh/plugin-infra/plugin-infra.sh
@@ -37,7 +37,7 @@ apply_manifest() {
   local script_dir
   script_dir="$(dirname "$(realpath "$0")")"
 
-  if [ -f "${script_dir}/${file}" ]; then
+  if [[ -f "${script_dir}/${file}" ]]; then
     echo "Using local file: ${file}"
     kubectl "$action" -f "${script_dir}/${file}"
   else

From ccc3c8ab08d342fc1ef0433651964cdc16298140 Mon Sep 17 00:00:00 2001
From: rhdh-bot <rhdh-bot@redhat.com>
Date: Tue, 7 Jul 2026 16:20:38 -0300
Subject: [PATCH 4/4] chore: regenerate bundle manifests

---
 ...kstage-operator.clusterserviceversion.yaml |  2 +-
 ...kstage-operator.clusterserviceversion.yaml |  2 +-
 .../rhdh-plugin-deps_v1_configmap.yaml        | 19 +++++++++++++------
 dist/rhdh/install.yaml                        | 19 +++++++++++++------
 4 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml b/bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml
index 0180cdf64..7bb172649 100644
--- a/bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml
+++ b/bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml
@@ -25,7 +25,7 @@ metadata:
           }
         }
       ]
-    createdAt: "2026-07-02T07:50:44Z"
+    createdAt: "2026-07-07T19:20:23Z"
     description: Backstage Operator
     operators.operatorframework.io/builder: operator-sdk-v1.42.2
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
diff --git a/bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml b/bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml
index b510edd47..efa6a17fe 100644
--- a/bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml
+++ b/bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml
@@ -29,7 +29,7 @@ metadata:
     categories: Developer Tools
     certified: "true"
     containerImage: registry.redhat.io/rhdh/rhdh-rhel9-operator:1.11
-    createdAt: "2026-07-02T07:50:46Z"
+    createdAt: "2026-07-07T19:20:26Z"
     description: Red Hat Developer Hub is a Red Hat supported version of Backstage.
       It comes with pre-built plug-ins and configuration settings, supports use of
       an external database, and can help streamline the process of setting up a self-managed
diff --git a/bundle/rhdh/manifests/rhdh-plugin-deps_v1_configmap.yaml b/bundle/rhdh/manifests/rhdh-plugin-deps_v1_configmap.yaml
index f03631f0a..bff70f0d4 100644
--- a/bundle/rhdh/manifests/rhdh-plugin-deps_v1_configmap.yaml
+++ b/bundle/rhdh/manifests/rhdh-plugin-deps_v1_configmap.yaml
@@ -330,8 +330,9 @@ data:
           image: registry.access.redhat.com/ubi9-minimal
           workingDir: $(workspaces.workflow-source.path)
           script: |
-            ROOT=/workspace/workflow
-            TARGET=flat
+            #!/usr/bin/env sh
+            set -eu
+
             mkdir -p flat
 
             if [ -d "workflow/$(params.workflowId)" ]; then
@@ -342,7 +343,7 @@ data:
               cp workflow/LICENSE flat/$(params.workflowId)
             fi
 
-            if [ "$(params.convertToFlat)" == "false" ]; then
+            if [ "$(params.convertToFlat)" = "false" ]; then
               rm -rf workflow/src/main/resources
               mv workflow/src flat/$(params.workflowId)/
             fi
@@ -368,6 +369,9 @@ data:
           image: registry.access.redhat.com/ubi9-minimal
           workingDir: $(workspaces.workflow-source.path)/flat/$(params.workflowId)
           script: |
+            #!/usr/bin/env sh
+            set -eu
+
             microdnf install -y tar gzip
             KN_CLI_URL="https://developers.redhat.com/content-gateway/file/pub/cgw/serverless-logic/1.38.0/kn-workflow-linux-amd64.tar.gz"
             curl -L "$KN_CLI_URL" | tar -xz --no-same-owner && chmod +x kn-workflow-linux-amd64 && mv kn-workflow-linux-amd64 kn-workflow
@@ -393,10 +397,13 @@ data:
           image: registry.access.redhat.com/ubi9-minimal
           workingDir: $(workspaces.workflow-gitops.path)/workflow-gitops
           script: |
-            cp $(workspaces.workflow-source.path)/flat/$(params.workflowId)/manifests/* kustomize/base
+            #!/usr/bin/env sh
+            set -eu
+
+            cp "$(workspaces.workflow-source.path)/flat/$(params.workflowId)/manifests/"* kustomize/base
             microdnf install -y findutils && microdnf clean all
-            cd kustomize
-            ./updater.sh $(params.workflowId) $(params.imageTag)
+            cd kustomize || exit
+            ./updater.sh "$(params.workflowId)" "$(params.imageTag)"
     ---
     apiVersion: tekton.dev/v1
     kind: Pipeline
diff --git a/dist/rhdh/install.yaml b/dist/rhdh/install.yaml
index 4ca4042eb..29e37daf8 100644
--- a/dist/rhdh/install.yaml
+++ b/dist/rhdh/install.yaml
@@ -3718,8 +3718,9 @@ data:
           image: registry.access.redhat.com/ubi9-minimal
           workingDir: $(workspaces.workflow-source.path)
           script: |
-            ROOT=/workspace/workflow
-            TARGET=flat
+            #!/usr/bin/env sh
+            set -eu
+
             mkdir -p flat
 
             if [ -d "workflow/$(params.workflowId)" ]; then
@@ -3730,7 +3731,7 @@ data:
               cp workflow/LICENSE flat/$(params.workflowId)
             fi
 
-            if [ "$(params.convertToFlat)" == "false" ]; then
+            if [ "$(params.convertToFlat)" = "false" ]; then
               rm -rf workflow/src/main/resources
               mv workflow/src flat/$(params.workflowId)/
             fi
@@ -3756,6 +3757,9 @@ data:
           image: registry.access.redhat.com/ubi9-minimal
           workingDir: $(workspaces.workflow-source.path)/flat/$(params.workflowId)
           script: |
+            #!/usr/bin/env sh
+            set -eu
+
             microdnf install -y tar gzip
             KN_CLI_URL="https://developers.redhat.com/content-gateway/file/pub/cgw/serverless-logic/1.38.0/kn-workflow-linux-amd64.tar.gz"
             curl -L "$KN_CLI_URL" | tar -xz --no-same-owner && chmod +x kn-workflow-linux-amd64 && mv kn-workflow-linux-amd64 kn-workflow
@@ -3781,10 +3785,13 @@ data:
           image: registry.access.redhat.com/ubi9-minimal
           workingDir: $(workspaces.workflow-gitops.path)/workflow-gitops
           script: |
-            cp $(workspaces.workflow-source.path)/flat/$(params.workflowId)/manifests/* kustomize/base
+            #!/usr/bin/env sh
+            set -eu
+
+            cp "$(workspaces.workflow-source.path)/flat/$(params.workflowId)/manifests/"* kustomize/base
             microdnf install -y findutils && microdnf clean all
-            cd kustomize
-            ./updater.sh $(params.workflowId) $(params.imageTag)
+            cd kustomize || exit
+            ./updater.sh "$(params.workflowId)" "$(params.imageTag)"
     ---
     apiVersion: tekton.dev/v1
     kind: Pipeline