bash-ops

# Bash Operations Defensive Bash for scripts that run unattended — CI steps, automation, and the `scripts/` a skill ships. The goal: a script that **fails loudly on the first problem, never corrupts state, and emits parseable output**. This is the house standard for any shell script in this repo. The script contract below is the same one enforced by [`docs/SKILL-RESOURCE-PROTOCOL.md`](../../docs/SKILL-RESOURCE-PROTOCOL.md) §2–§7 — that protocol governs every skill resource, and its rules *are* bash rules. Treat the two as one standard: the resource protocol decides **what** a skill script must guarantee (streams, exit codes, help block); this skill teaches **how** to write the Bash that delivers it. The canonical reference implementation is [`skills/supply-chain-defense/scripts/preinstall-check.sh`](../supply-chain-defense/scripts/preinstall-check.sh) — read it whenever you need a worked example of every rule here applied at once. ## Bash vs Python — choose before you write Reach for Python (and the `python-cli-ops` skill) when a script grows past **~100 lines**, needs **data structures** (nested maps, JSON manipulation beyond a `jq` filter), arithmetic beyond integers, or string processing with real parsing. Bash excels at **gluing processes together**: launching tools, moving files, checking conditions, wiring pipelines. The moment you find yourself simulating a hash-of-hashes or doing float math, stop — that's Python's job. This mirrors SKILL-RESOURCE-PROTOCOL §3, whic...