Shell script hardening: set -euo pipefail across all scripts

[Copilot]

Scripts used only set -e, leaving unset variable references silently expanding to empty strings and pipe failures going undetected — both dangerous when handling secrets or rendering configs.

Changes

• #!/bin/sh → #!/bin/bash on all scripts — required since pipefail is a bash extension unavailable in POSIX sh/dash
• set -e / set -eu → set -euo pipefail across all 17 scripts in scripts/ and config/postgres/init-databases.sh
• lib.sh: changed sh "$pre_start_script" → "$pre_start_script" — explicit sh invocation bypasses the shebang, running under dash and silently dropping pipefail

# Before
#!/bin/sh
set -e

# After
#!/bin/bash
set -euo pipefail

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[florianajir]

@copilot test failed fix it

[Copilot]

@copilot test failed fix it

Fixed in eb0f844. The CI workflow was invoking scripts with sh ./scripts/authelia-pre-start.sh which bypasses the shebang and runs under dash — which doesn't support -o pipefail. Updated the two calls in .github/workflows/ci.yml to use bash instead.