Repository: microsoft/CBL-Mariner
File: scripts/publish-sig-image.sh (Shell)

Code before:
#!/bin/bash
# https://basevmimage.blob.core.windows.net/vhds/azl4-vm-base.x86_64-0.1.vhd
# Find the absolute path of the directory containing this script
SCRIPTS_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
. "$SCRIPTS_DIR/common.sh"

storage_account_url="https://$STORAGE_ACCOUNT_NAME.blob.core.windows.net"
storage_account_resource_id="/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP_NAME/providers/Microsoft.Storage/storageAccounts/$STORAGE_ACCOUNT_NAME"

replicationMode="Shallow"
image_version=$VERSION
storage_blob_endpoint="$storage_account_url/$STORAGE_CONTAINER_NAME/$storage_blob_name"

az account set --subscription "$SUBSCRIPTION_ID"

if [ "$(az group exists -n "$RESOURCE_GROUP_NAME")" == "false" ]; then
    az group create \
        --name "$RESOURCE_GROUP_NAME" \
        --location "$LOCATION"
fi

# Ensure STORAGE_ACCOUNT_NAME exists and the managed identity has access
storage_account_resource_id="/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP_NAME/providers/Microsoft.Storage/storageAccounts/$STORAGE_ACCOUNT_NAME"
if ! az storage account show --ids "$storage_account_resource_id"; then
    echo "Could not find storage account \"$STORAGE_ACCOUNT_NAME\" in the expected location. Creating the storage account."

    if [ "$(az storage account check-name --name "$STORAGE_ACCOUNT_NAME" --query nameAvailable)" == "false" ]; then
        echo "Storage account name $STORAGE_ACCOUNT_NAME is not available"
        exit 1
    fi
    az storage account create \
        --resource-group "$RESOURCE_GROUP_NAME" \
        --name "$STORAGE_ACCOUNT_NAME" \
        --location "$LOCATION" \
        --allow-shared-key-access false
fi

Review comment (suggestion):
suggestion (non-blocking): Consider a future change to automatically update the image_version value so users can keep uploading new images to the same SIG, but with different increasing version numbers.

Code after:
#!/bin/bash
set -euxo pipefail
# Find the absolute path of the directory containing this script
SCRIPTS_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
. "$SCRIPTS_DIR/common.sh"

storage_account_url="https://$STORAGE_ACCOUNT_NAME.blob.core.windows.net"
storage_account_resource_id="/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP_NAME/providers/Microsoft.Storage/storageAccounts/$STORAGE_ACCOUNT_NAME"

replicationMode="Shallow"
storage_blob_endpoint="$storage_account_url/$STORAGE_CONTAINER_NAME/$STORAGE_BLOB_NAME"

az account set --subscription "$SUBSCRIPTION_ID"

if [ "$(az group exists -n "$RESOURCE_GROUP_NAME")" == "false" ]; then
    az group create \
        --name "$RESOURCE_GROUP_NAME" \
        --location "$LOCATION"
fi

# Ensure STORAGE_ACCOUNT_NAME exists and the managed identity has access
if ! az storage account show --ids "$storage_account_resource_id"; then
    echo "Could not find storage account \"$STORAGE_ACCOUNT_NAME\" in the expected location. Creating the storage account."

    if [ "$(az storage account check-name --name "$STORAGE_ACCOUNT_NAME" --query nameAvailable)" == "false" ]; then
        echo "Storage account name $STORAGE_ACCOUNT_NAME is not available"
        exit 1
    fi
    az storage account create \
        --resource-group "$RESOURCE_GROUP_NAME" \
        --name "$STORAGE_ACCOUNT_NAME" \
        --location "$LOCATION" \
        --allow-shared-key-access false
fi

# Ensure "build_target" storage container exists