opea-project · sgurunat · Aug 17, 2026
diff --git a/.shellcheckrc b/.shellcheckrc
@@ -0,0 +1,2 @@
+external-sources=true
+source-path=SCRIPTDIR
diff --git a/blueprints/finetuning_service/scripts/setup-keycloak-finetuning.sh b/blueprints/finetuning_service/scripts/setup-keycloak-finetuning.sh
@@ -18,7 +18,7 @@ set -e
 
 # Get Keycloak URL from kubectl
 KEYCLOAK_SERVICE=$(kubectl get svc -n default -l app.kubernetes.io/name=keycloak -o jsonpath='{.items[0].metadata.name}')
-KEYCLOAK_PORT=$(kubectl get svc -n default ${KEYCLOAK_SERVICE} -o jsonpath='{.spec.ports[?(@.name=="http")].port}')
+KEYCLOAK_PORT=$(kubectl get svc -n default "${KEYCLOAK_SERVICE}" -o jsonpath='{.spec.ports[?(@.name=="http")].port}')
 KEYCLOAK_URL="http://${KEYCLOAK_SERVICE}.default.svc.cluster.local:${KEYCLOAK_PORT}"
 
 # Get admin credentials from inference config

diff --git a/blueprints/finetuning_service/src/api/buildkit/deploy-finetuning.sh b/blueprints/finetuning_service/src/api/buildkit/deploy-finetuning.sh
@@ -1,11 +1,14 @@
 #!/bin/bash
+# Copyright (C) 2025-2026 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
 
 set -e
 
 # Get the absolute path of the finetuning-service root directory
 # buildkit is 1 level deep from root
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-export BUILD_CONTEXT="$(cd "$SCRIPT_DIR/.." && pwd)"
+BUILD_CONTEXT="$(cd "$SCRIPT_DIR/.." && pwd)"
+export BUILD_CONTEXT
 export REGISTRY_URL="${REGISTRY_URL:-registry.kube-system.svc.cluster.local:5000}"
 export IMAGE_TAG="${IMAGE_TAG:-latest}"
 export NAMESPACE="${NAMESPACE:-finetuning}"
@@ -49,7 +52,7 @@ sleep 3
 
 # Show logs
 POD_NAME=""
-for i in {1..30}; do
+for _ in {1..30}; do
   POD_NAME=$(kubectl get pods -n "$NAMESPACE" -l job-name=buildkit-finetuning-service -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
   if [ -n "$POD_NAME" ]; then
     break

diff --git a/blueprints/finetuning_service/src/api/kaniko/deploy-finetuning.sh b/blueprints/finetuning_service/src/api/kaniko/deploy-finetuning.sh
@@ -1,11 +1,14 @@
 #!/bin/bash
+# Copyright (C) 2025-2026 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
 
 set -e
 
 # Get the absolute path of the finetuning-service root directory
 # kaniko is 1 level deep from root
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-export BUILD_CONTEXT="$(cd "$SCRIPT_DIR/.." && pwd)"
+BUILD_CONTEXT="$(cd "$SCRIPT_DIR/.." && pwd)"
+export BUILD_CONTEXT
 export REGISTRY_URL="${REGISTRY_URL:-registry.kube-system.svc.cluster.local:5000}"
 export IMAGE_TAG="${IMAGE_TAG:-latest}"
 export NAMESPACE="${NAMESPACE:-finetuning}"
@@ -59,7 +62,7 @@ sleep 3
 
 # Show logs
 POD_NAME=""
-for i in {1..30}; do
+for _ in {1..30}; do
   POD_NAME=$(kubectl get pods -n "$NAMESPACE" -l job-name=kaniko-finetuning-service -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
   if [ -n "$POD_NAME" ]; then
     break

diff --git a/blueprints/finetuning_service/src/api/scripts/deploy.sh b/blueprints/finetuning_service/src/api/scripts/deploy.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# Copyright (C) 2025-2026 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
 set -e
 
 # Get the directory where this script is located and go to project root
@@ -25,6 +27,7 @@ if [ ! -f .env ]; then
 fi
 
 # Load environment variables
+# shellcheck source=/dev/null  # generated at runtime by setup.sh
 source .env
 
 # Set defaults
@@ -75,7 +78,7 @@ echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo "📦 Step 1: Creating namespace..."
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-kubectl create namespace $NAMESPACE --dry-run=client -o yaml | kubectl apply -f -
+kubectl create namespace "$NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
 echo "✓ Namespace ready"
 echo ""
 
@@ -86,7 +89,7 @@ echo "━━━━━━━━━━━━━━━━━━━━━━━━
 if kubectl get secret finetuning-backend-secret -n default >/dev/null 2>&1; then
   kubectl get secret finetuning-backend-secret -n default -o yaml \
     | sed "s/namespace: default/namespace: $NAMESPACE/" \
-    | kubectl apply -n $NAMESPACE -f -
+    | kubectl apply -n "$NAMESPACE" -f -
   echo "✓ OIDC secret copied from default namespace"
 else
   echo "⚠️  Warning: finetuning-backend-secret not found in default namespace"
@@ -142,17 +145,17 @@ else
         echo "Found key: $KEY_FILE"
 
         # Check if secret already exists
-        if kubectl get secret finetuning-api-tls -n $NAMESPACE >/dev/null 2>&1; then
+        if kubectl get secret finetuning-api-tls -n "$NAMESPACE" >/dev/null 2>&1; then
             echo "Updating existing TLS secret..."
-            kubectl delete secret finetuning-api-tls -n $NAMESPACE
+            kubectl delete secret finetuning-api-tls -n "$NAMESPACE"
         else
             echo "Creating new TLS secret..."
         fi
 
         kubectl create secret tls finetuning-api-tls \
             --cert="$CERT_FILE" \
             --key="$KEY_FILE" \
-            -n $NAMESPACE
+            -n "$NAMESPACE"
 
         echo "✓ TLS secret created successfully"
     fi
@@ -172,8 +175,7 @@ export REGISTRY_URL="${REGISTRY_URL:-registry.kube-system.svc.cluster.local:5000
 # Run kaniko build
 if [ -f ./kaniko/deploy-finetuning.sh ]; then
     echo "Building image: $REGISTRY_URL/finetuning-service:$IMAGE_TAG"
-    ./kaniko/deploy-finetuning.sh
-    if [ $? -ne 0 ]; then
+    if ! ./kaniko/deploy-finetuning.sh; then
         echo "❌ Build failed!"
         exit 1
     fi
@@ -189,7 +191,7 @@ echo "🚀 Step 3: Deploying PostgreSQL..."
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
 # Check if PostgreSQL release exists
-if helm list -n $NAMESPACE | grep -q "^finetuning-service-postgresql\s"; then
+if helm list -n "$NAMESPACE" | grep -q "^finetuning-service-postgresql\s"; then
     echo "Upgrading existing PostgreSQL..."
     HELM_PG_CMD="upgrade"
 else
@@ -199,7 +201,7 @@ fi
 
 # Deploy PostgreSQL
 helm $HELM_PG_CMD finetuning-service-postgresql ./helm-charts/postgresql \
-  --namespace $NAMESPACE \
+  --namespace "$NAMESPACE" \
   --set auth.password="$POSTGRES_PASSWORD" \
   --wait --timeout 5m
 
@@ -211,7 +213,7 @@ echo "🚀 Step 4: Deploying Application..."
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
 # Check if release exists
-if helm list -n $NAMESPACE | grep -q "^finetuning-service\s"; then
+if helm list -n "$NAMESPACE" | grep -q "^finetuning-service\s"; then
     echo "Upgrading existing deployment..."
     HELM_CMD="upgrade"
 else
@@ -221,7 +223,7 @@ fi
 
 # Deploy with Helm
 helm $HELM_CMD finetuning-service ./helm-charts/finetuning-api \
-  --namespace $NAMESPACE \
+  --namespace "$NAMESPACE" \
   --set secrets.databaseUrl="postgresql://finetuning:$POSTGRES_PASSWORD@finetuning-service-postgresql:5432/finetuning" \
   --set secrets.nvidiaApiKey="$NVIDIA_API_KEY" \
   --set app.config.nvidiaApiUrl="$NVIDIA_API_URL" \
@@ -241,18 +243,18 @@ echo "━━━━━━━━━━━━━━━━━━━━━━━━
 echo "Waiting for PostgreSQL..."
 kubectl wait --for=condition=ready pod \
   -l app=postgres \
-  -n $NAMESPACE \
+  -n "$NAMESPACE" \
   --timeout=300s || true
 
 # Check if database is initialized
-POD_NAME=$(kubectl get pods -n $NAMESPACE -l app=postgres -o jsonpath='{.items[0].metadata.name}')
+POD_NAME=$(kubectl get pods -n "$NAMESPACE" -l app=postgres -o jsonpath='{.items[0].metadata.name}')
 if [ ! -z "$POD_NAME" ]; then
     echo "Checking database schema..."
-    TABLE_COUNT=$(kubectl exec -n $NAMESPACE $POD_NAME -- psql -U finetuning -d finetuning -tAc "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='public';" 2>/dev/null || echo "0")
+    TABLE_COUNT=$(kubectl exec -n "$NAMESPACE" "$POD_NAME" -- psql -U finetuning -d finetuning -tAc "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='public';" 2>/dev/null || echo "0")
 
     if [ "$TABLE_COUNT" = "0" ]; then
         echo "Initializing database schema..."
-        cat "$PROJECT_ROOT/init-db.sql" | kubectl exec -n $NAMESPACE -i $POD_NAME -- psql -U finetuning -d finetuning
+        cat "$PROJECT_ROOT/init-db.sql" | kubectl exec -n "$NAMESPACE" -i "$POD_NAME" -- psql -U finetuning -d finetuning
         echo "✓ Database initialized"
     else
         echo "✓ Database already initialized ($TABLE_COUNT tables found)"
@@ -266,7 +268,7 @@ echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo "⏳ Step 6: Waiting for application to be ready..."
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-kubectl rollout status deployment/finetuning-service -n $NAMESPACE --timeout=5m
+kubectl rollout status deployment/finetuning-service -n "$NAMESPACE" --timeout=5m
 
 echo "✓ Application is ready"
 echo ""
@@ -276,9 +278,9 @@ echo "━━━━━━━━━━━━━━━━━━━━━━━━
 echo "📊 Deployment Status"
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo ""
-kubectl get pods -n $NAMESPACE
+kubectl get pods -n "$NAMESPACE"
 echo ""
-kubectl get ingress -n $NAMESPACE
+kubectl get ingress -n "$NAMESPACE"
 echo ""
 
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

diff --git a/blueprints/finetuning_service/src/api/scripts/setup.sh b/blueprints/finetuning_service/src/api/scripts/setup.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
+# Copyright (C) 2025-2026 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
 set -e
 
 # Get the directory where this script is located and go to project root
@@ -42,28 +44,28 @@ echo ""
 echo "🎯 Training Backend Configuration"
 echo "This is the URL of your training backend service (e.g., Nvidia GPU server)."
 echo ""
-read -p "Training Backend URL (e.g., https://training.example.com:8443): " NVIDIA_API_URL
+read -r -p "Training Backend URL (e.g., https://training.example.com:8443): " NVIDIA_API_URL
 while [ -z "$NVIDIA_API_URL" ]; do
     echo "❌ Training Backend URL is required!"
-    read -p "Training Backend URL: " NVIDIA_API_URL
+    read -r -p "Training Backend URL: " NVIDIA_API_URL
 done
 
 echo ""
-read -p "Training Backend API Key: " NVIDIA_API_KEY
+read -r -p "Training Backend API Key: " NVIDIA_API_KEY
 while [ -z "$NVIDIA_API_KEY" ]; do
     echo "❌ Training Backend API Key is required!"
-    read -p "Training Backend API Key: " NVIDIA_API_KEY
+    read -r -p "Training Backend API Key: " NVIDIA_API_KEY
 done
 
 # Domain Configuration
 echo ""
 echo "🌐 Domain Configuration"
 echo "The API will be accessible at: https://YOUR_DOMAIN/enterprise-ai"
 echo ""
-read -p "Your domain name (e.g., example.com): " BASE_DOMAIN
+read -r -p "Your domain name (e.g., example.com): " BASE_DOMAIN
 while [ -z "$BASE_DOMAIN" ]; do
     echo "❌ Domain name is required!"
-    read -p "Your domain name: " BASE_DOMAIN
+    read -r -p "Your domain name: " BASE_DOMAIN
 done
 
 # TLS Certificates Path
@@ -72,7 +74,7 @@ echo "🔒 TLS Certificates Configuration"
 echo "Provide the path to directory containing your TLS certificates."
 echo "Expected files: tls.crt (or cert.pem) and tls.key (or key.pem)"
 echo ""
-read -p "Path to certs directory (default: ../certs): " CERTS_PATH
+read -r -p "Path to certs directory (default: ../certs): " CERTS_PATH
 CERTS_PATH=${CERTS_PATH:-../certs}
 
 # Validate certs path
@@ -83,14 +85,14 @@ fi
 
 # Namespace
 echo ""
-read -p "Kubernetes namespace (default: finetuning): " NAMESPACE
+read -r -p "Kubernetes namespace (default: finetuning): " NAMESPACE
 NAMESPACE=${NAMESPACE:-finetuning}
 
 # Optional: Dataprep API
 echo ""
 echo "🔧 Optional: Dataprep API"
 echo "If you have a separate dataprep service, provide the URL. Otherwise, leave empty."
-read -p "Dataprep API URL (optional, press Enter to skip): " DATAPREP_API_URL
+read -r -p "Dataprep API URL (optional, press Enter to skip): " DATAPREP_API_URL
 
 echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

diff --git a/blueprints/finetuning_service/src/dataprep/buildkit/celery/deploy-celery.sh b/blueprints/finetuning_service/src/dataprep/buildkit/celery/deploy-celery.sh
@@ -1,10 +1,13 @@
 #!/bin/bash
+# Copyright (C) 2025-2026 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
 set -e
 #sudo apt-get install gettext-base
 # Get the absolute path of the dataprep directory
 # buildkit/celery is 2 levels deep from dataprep root
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-export BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+export BUILD_CONTEXT
 export REGISTRY_URL="${REGISTRY_URL:-registry.kube-system.svc.cluster.local:5000}"
 
 echo "Building with context: $BUILD_CONTEXT"
@@ -24,7 +27,7 @@ export DB_HOST=postgres.dataprep.svc.cluster.local
 export DB_PORT=5432
 export DB_NAME=dataprep
 export DB_USER=postgres
-export DB_PASSWORD=postgres
+export DB_PASSWORD="${DB_PASSWORD:-postgres}"
 export DB_POOL_SIZE=5
 export DB_MAX_OVERFLOW=10
 

diff --git a/blueprints/finetuning_service/src/dataprep/buildkit/data-prep/deploy-dataprep.sh b/blueprints/finetuning_service/src/dataprep/buildkit/data-prep/deploy-dataprep.sh
@@ -1,11 +1,14 @@
 #!/bin/bash
+# Copyright (C) 2025-2026 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
 
 set -e
 
 # Get the absolute path of the dataprep directory
 # buildkit/data-prep is 3 levels deep from data-prep-backend root
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-export BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+export BUILD_CONTEXT
 export REGISTRY_URL="${REGISTRY_URL:-registry.kube-system.svc.cluster.local:5000}"
 
 echo "Building with context: $BUILD_CONTEXT"
@@ -25,7 +28,7 @@ export DB_HOST=postgres.dataprep.svc.cluster.local
 export DB_PORT=5432
 export DB_NAME=dataprep
 export DB_USER=postgres
-export DB_PASSWORD=postgres
+export DB_PASSWORD="${DB_PASSWORD:-postgres}"
 export DB_POOL_SIZE=5
 export DB_MAX_OVERFLOW=10
 

diff --git a/blueprints/finetuning_service/src/dataprep/kaniko/celery/deploy-celery.sh b/blueprints/finetuning_service/src/dataprep/kaniko/celery/deploy-celery.sh
@@ -1,10 +1,13 @@
 #!/bin/bash
+# Copyright (C) 2025-2026 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
 set -e
 #sudo apt-get install gettext-base
 # Get the absolute path of the dataprep directory
 # kaniko/celery is 2 levels deep from dataprep root
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-export BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+export BUILD_CONTEXT
 export REGISTRY_URL="${REGISTRY_URL:-registry.kube-system.svc.cluster.local:5000}"
 
 echo "Building with context: $BUILD_CONTEXT"
@@ -24,7 +27,7 @@ export DB_HOST=postgres.dataprep.svc.cluster.local
 export DB_PORT=5432
 export DB_NAME=dataprep
 export DB_USER=postgres
-export DB_PASSWORD=postgres
+export DB_PASSWORD="${DB_PASSWORD:-postgres}"
 export DB_POOL_SIZE=5
 export DB_MAX_OVERFLOW=10
 

diff --git a/blueprints/finetuning_service/src/dataprep/kaniko/data-prep/deploy-dataprep.sh b/blueprints/finetuning_service/src/dataprep/kaniko/data-prep/deploy-dataprep.sh
@@ -1,11 +1,14 @@
 #!/bin/bash
+# Copyright (C) 2025-2026 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
 
 set -e
 
 # Get the absolute path of the dataprep directory
 # kaniko/data-prep is 3 levels deep from data-prep-backend root
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-export BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+export BUILD_CONTEXT
 export REGISTRY_URL="${REGISTRY_URL:-registry.kube-system.svc.cluster.local:5000}"
 
 echo "Building with context: $BUILD_CONTEXT"
@@ -25,7 +28,7 @@ export DB_HOST=postgres.dataprep.svc.cluster.local
 export DB_PORT=5432
 export DB_NAME=dataprep
 export DB_USER=postgres
-export DB_PASSWORD=postgres
+export DB_PASSWORD="${DB_PASSWORD:-postgres}"
 export DB_POOL_SIZE=5
 export DB_MAX_OVERFLOW=10
 

diff --git a/blueprints/finetuning_service/src/ui/deployment/buildkit/deploy-frontend.sh b/blueprints/finetuning_service/src/ui/deployment/buildkit/deploy-frontend.sh
@@ -1,9 +1,12 @@
 #!/bin/bash
+# Copyright (C) 2025-2026 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
 set -e
 #sudo apt-get install gettext-base
 # Get the absolute path of the ui directory
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-export BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+BUILD_CONTEXT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+export BUILD_CONTEXT
 export REGISTRY_URL="${REGISTRY_URL:-registry.kube-system.svc.cluster.local:5000}"
 
 echo "Building with context: $BUILD_CONTEXT"
@@ -36,7 +39,7 @@ echo "Monitor with: kubectl logs -f job/buildkit-frontend -n ${NAMESPACE:-finetu
 
 # Wait for pod to start
 echo "Waiting for BuildKit pod to start..."
-for i in $(seq 1 60); do
+for _ in $(seq 1 60); do
   POD_NAME=$(kubectl get pods -n "${NAMESPACE:-finetuning-ui}" -l job-name=buildkit-frontend -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
   if [ -n "$POD_NAME" ]; then
     echo "Pod started: $POD_NAME"