Fix Bash script body leak on job cancellation
What does this MR do?
Backports the Bash script-body leak fix from
!6784 (merged) to the
19-0-stable branch.
Cancelling a job whose container shell is Bash 5.3 (or older than 4.4)
leaked the entire step_script and environment variables to the job
log. The user script now runs in an explicit subshell with stdin closed
via < /dev/null and the TERM trap re-installed inside it, so SIGTERM
exits cleanly instead of a signal-induced death that dumps the eval
body. The new FF_USE_LEGACY_BASH_EVAL flag restores the previous
behaviour, and FF_USE_NEW_BASH_EVAL_STRATEGY becomes a deprecated
no-op.
This also corrects a pre-existing malformed trap exit 1 TERM to
trap 'exit 1' TERM on this branch.
Backport notes
This is a clean cherry-pick of the merge commit, except that the
step-runner clone-step ScriptSections wiring carried by the original
change is omitted: that field is not set on those steps on
19-0-stable (it was added on main by an unrelated change), so it is
left out to keep the backport minimal. The net change versus
19-0-stable is exactly the leak fix.
The bash-specific buildtest helpers add //nolint:goconst on the
"bash" shell comparisons to satisfy the linter on this branch.
Why is this needed
Required for the 19.0 patch release. See https://gitlab.com/gitlab-org/gitlab-runner/-/issues/39467.
Closes https://gitlab.com/gitlab-org/gitlab-runner/-/issues/39467