feat(aws-test-infra): add s3-stage, s3-download, s3-cleanup subcommands

.github/actions/aws-test-infra/action.yml

@@ -3,14 +3,15 @@ description: 'Provision or tear down AWS test infrastructure (VPC + subnet + IGW
 
 inputs:
   command:
-    description: 'Subcommand: provision or cleanup'
+    description: 'Subcommand: provision | cleanup | s3-stage | s3-download | s3-cleanup'
     required: true
   region:
     description: 'AWS region'
     required: true
   run-id:
-    description: 'Unique run identifier; tagged on every resource as RunID'
-    required: true
+    description: 'Unique run identifier; tagged as RunID on provisioned resources and on s3-stage buckets. For s3-stage the bucket name defaults to the lowercased run-id.'
+    required: false
+    default: ''
 
   # Provision-only inputs ────────────────────────────────────────────────
   consumer-tag:
@@ -140,10 +141,40 @@ inputs:
     required: false
     default: 'false'
   strict-sweep:
-    description: '(cleanup) Fail the cleanup step on sweep errors. Default false matches the original Bash teardown (set +e). Set true if you would rather see sweep failures than silently leak resources on AWS API hiccups.'
+    description: '(cleanup, s3-cleanup) Fail the step on sweep errors. Default false matches the original Bash teardown (set +e). Set true if you would rather see sweep failures than silently leak resources on AWS API hiccups.'
     required: false
     default: 'false'
 
+  # S3 inputs (s3-stage / s3-download / s3-cleanup) ───────────────────────
+  bucket:
+    description: '(s3-*) Bucket name. For s3-stage it defaults to the lowercased run-id. Required for s3-download. For s3-cleanup, pass the bucket to delete directly and/or bucket-prefix for the tag sweep.'
+    required: false
+    default: ''
+  uploads:
+    description: '(s3-stage) Newline-separated local-path=object-key pairs to upload. Example: "vcluster_image=vcluster.tar\n/tmp/kind-node.tar.gz=kind-node.tar.gz"'
+    required: false
+    default: ''
+  presign:
+    description: '(s3-stage) Newline-separated object-key:method pairs to presign (method get|put). Example: "vcluster.tar:get\nresults.tar.gz:put". Read the result via fromJSON(outputs.presigned-urls).<key>.'
+    required: false
+    default: ''
+  expires-in:
+    description: '(s3-stage) Presigned URL lifetime as a Go duration (e.g. 4h, 14400s).'
+    required: false
+    default: '4h'
+  key:
+    description: '(s3-download) Object key to download.'
+    required: false
+    default: ''
+  dest:
+    description: '(s3-download) Local destination path.'
+    required: false
+    default: ''
+  bucket-prefix:
+    description: '(s3-cleanup) Bucket name prefix for the tag-based sweep fallback.'
+    required: false
+    default: ''
+
 outputs:
   vpc-id:
     description: 'Created VPC ID'
@@ -184,6 +215,12 @@ outputs:
   instance-id-by-role:
     description: 'JSON map of role → instance ID. Use for arbitrary role names (anything other than primary/worker1/worker2). Consumer accesses with `fromJSON(steps.<id>.outputs.instance-id-by-role).<role>`.'
     value: ${{ steps.run.outputs.instance_id_by_role }}
+  bucket:
+    description: '(s3-stage) Bucket name that was ensured/used.'
+    value: ${{ steps.run.outputs.bucket }}
+  presigned-urls:
+    description: '(s3-stage) JSON map of object-key → presigned URL. Access with `fromJSON(steps.<id>.outputs.presigned-urls).<key>`.'
+    value: ${{ steps.run.outputs.presigned_urls }}
 
 runs:
   using: 'composite'
@@ -260,6 +297,14 @@ runs:
         INPUT_SKIP_DIRECT: ${{ inputs.skip-direct }}
         INPUT_SKIP_SWEEP: ${{ inputs.skip-sweep }}
         INPUT_STRICT_SWEEP: ${{ inputs.strict-sweep }}
+        # S3
+        INPUT_BUCKET: ${{ inputs.bucket }}
+        INPUT_UPLOADS: ${{ inputs.uploads }}
+        INPUT_PRESIGN: ${{ inputs.presign }}
+        INPUT_EXPIRES_IN: ${{ inputs.expires-in }}
+        INPUT_KEY: ${{ inputs.key }}
+        INPUT_DEST: ${{ inputs.dest }}
+        INPUT_BUCKET_PREFIX: ${{ inputs.bucket-prefix }}
       run: |
         set -euo pipefail
         ARGS=(-region="$INPUT_REGION" -run-id="$INPUT_RUN_ID")
@@ -306,8 +351,45 @@ runs:
             [ "$INPUT_STRICT_SWEEP" = "true" ] && ARGS+=(-strict-sweep)
             "$BINARY" cleanup "${ARGS[@]}"
             ;;
+          s3-stage)
+            # s3 commands have their own flag sets; build a dedicated arg list
+            # rather than reuse the provision/cleanup base (which carries flags
+            # they don't define).
+            S3ARGS=(-region="$INPUT_REGION" -run-id="$INPUT_RUN_ID")
+            [ -n "$INPUT_BUCKET" ] && S3ARGS+=(-bucket="$INPUT_BUCKET")
+            [ -n "$INPUT_EXPIRES_IN" ] && S3ARGS+=(-expires-in="$INPUT_EXPIRES_IN")
+            # Turn the newline-separated uploads/presign inputs into repeatable
+            # flags. parse-list.sh (tested with bats) does the trim/split so this
+            # YAML stays logic-free.
+            PARSE="$GITHUB_ACTION_PATH/src/parse-list.sh"
+            # Capture into a variable first so `set -e`/`pipefail` sees a parse-list.sh
+            # failure; a `< <(...)` process substitution would swallow it and leave
+            # S3ARGS silently missing its -upload/-presign flags.
+            if [ -n "$INPUT_UPLOADS" ]; then
+              _uploads=$(printf '%s\n' "$INPUT_UPLOADS" | bash "$PARSE" -upload)
+              while IFS= read -r arg; do [ -n "$arg" ] && S3ARGS+=("$arg"); done <<< "$_uploads"
+            fi
+            if [ -n "$INPUT_PRESIGN" ]; then
+              _presign=$(printf '%s\n' "$INPUT_PRESIGN" | bash "$PARSE" -presign)
+              while IFS= read -r arg; do [ -n "$arg" ] && S3ARGS+=("$arg"); done <<< "$_presign"
+            fi
+            S3ARGS+=(-output="$GITHUB_OUTPUT" -output-format=github-output)
+            "$BINARY" s3-stage "${S3ARGS[@]}"
+            ;;
+          s3-download)
+            "$BINARY" s3-download -region="$INPUT_REGION" -bucket="$INPUT_BUCKET" -key="$INPUT_KEY" -dest="$INPUT_DEST"
+            ;;
+          s3-cleanup)
+            S3ARGS=(-region="$INPUT_REGION")
+            [ -n "$INPUT_RUN_ID" ] && S3ARGS+=(-run-id="$INPUT_RUN_ID")
+            [ -n "$INPUT_BUCKET" ] && S3ARGS+=(-bucket="$INPUT_BUCKET")
+            [ -n "$INPUT_BUCKET_PREFIX" ] && S3ARGS+=(-bucket-prefix="$INPUT_BUCKET_PREFIX")
+            [ "$INPUT_SKIP_SWEEP" = "true" ] && S3ARGS+=(-skip-sweep)
+            [ "$INPUT_STRICT_SWEEP" = "true" ] && S3ARGS+=(-strict)
+            "$BINARY" s3-cleanup "${S3ARGS[@]}"
+            ;;
           *)
-            echo "::error::Unknown command: $INPUT_CMD (must be 'provision' or 'cleanup')"
+            echo "::error::Unknown command: $INPUT_CMD (must be provision, cleanup, s3-stage, s3-download, or s3-cleanup)"
             exit 1
             ;;
         esac

.github/actions/aws-test-infra/src/go.mod

@@ -3,23 +3,27 @@ module github.com/loft-sh/github-actions/aws-test-infra
 go 1.24
 
 require (
-	github.com/aws/aws-sdk-go-v2 v1.41.7
+	github.com/aws/aws-sdk-go-v2 v1.42.1
 	github.com/aws/aws-sdk-go-v2/config v1.32.17
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.300.0
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.105.0
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.68.6
+	github.com/aws/smithy-go v1.27.3
 )
 
 require (
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.16 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31 // indirect
 	github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 // indirect
-	github.com/aws/smithy-go v1.25.1 // indirect
 )

.github/actions/aws-test-infra/src/go.sum

@@ -1,23 +1,31 @@
-github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
-github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
+github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek=
+github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 h1:3IZY0XAJquT3aHzbkHfPzy4ACPcEjVG0x87KOwtpqGY=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14/go.mod h1:zwM6veDkhGgQFqkBy+uT28AAYpLu+uFMlPl+rCg/73E=
 github.com/aws/aws-sdk-go-v2/config v1.32.17 h1:FpL4/758/diKwqbytU0prpuiu60fgXKUWCpDJtApclU=
 github.com/aws/aws-sdk-go-v2/config v1.32.17/go.mod h1:OXqUMzgXytfoF9JaKkhrOYsyh72t9G+MJH8mMRaexOE=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.16 h1:r3RJBuU7X9ibt8RHbMjWE6y60QbKBiII6wSrXnapxSU=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.16/go.mod h1:6cx7zqDENJDbBIIWX6P8s0h6hqHC8Avbjh9Dseo27ug=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 h1:UuSfcORqNSz/ey3VPRS8TcVH2Ikf0/sC+Hdj400QI6U=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23/go.mod h1:+G/OSGiOFnSOkYloKj/9M35s74LgVAdJBSD5lsFfqKg=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 h1:3GUprIsfmGcC5SACIyB0e7E0BM1O1b3Erl5CePYIAeQ=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31/go.mod h1:7PuV1yl5e2xnUbm+RqvVg5i2iBM8EyijZNoI9wsOoOc=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.300.0 h1:HgOfUy9Sm2Q9UQAyj9I/7NZhIaymTEakGA/FnLw65lw=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.300.0/go.mod h1:Y95W0Hm6FYLPa6o0hbnJ+sWgmdc4ifcLFjGkdobWVhY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 h1:FLudkZLt5ci0ozzgkVo8BJGwvqNaZbTWb3UcucAateA=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9/go.mod h1:w7wZ/s9qK7c8g4al+UyoF1Sp/Z45UwMGcqIzLWVQHWk=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 h1:pbrxO/kuIwgEsOPLkaHu0O+m4fNgLU8B3vxQ+72jTPw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23/go.mod h1:/CMNUqoj46HpS3MNRDEDIwcgEnrtZlKRaHNaHxIFpNA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 h1:mbRIur/BiHK6SKPjoBIXSE/hJ6g6JGRLuxQy1jGjlN4=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13/go.mod h1:ITg9em2KbJx1s0y4aqRX5OYWG6HBZ5TVR//OdpEZ2CQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 h1:9Fjh6fi/U5JEStVZijmaMpUwE/gvBJj7x2B/PjbO9To=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23/go.mod h1:iMoT2f1tClxrWAAnKCXjZQ6LOmfLrMG14wmnWpM+F14=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 h1:/Z5jmNrKsSD7EmDjzAPsm/3L9IuOkzaynklJZ1qX7S4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30/go.mod h1:lEzEZnOosE7zi8Z6royW1cFJTD9fpab4Ul1SBrllewk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31 h1:uao4A3QZ5UmB326V6KF+qRpv9Tjz7IlnlnTbbANntlU=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31/go.mod h1:I/1+z0VwL1GhQyLgkoHDlygpUZ+iTAwOQ/NsftiUL2I=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.105.0 h1:XptwLL+UHXgafYMIHTy59IRovLbhz3znkxY2uS/pbXU=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.105.0/go.mod h1:zdmCoFO/dSI7GlrwsPqFJI+WlFnSU4Tc8TJnlXrM1Do=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 h1:TdJ+HdzOBhU8+iVAOGUTU63VXopcumCOF1paFulHWZc=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.11/go.mod h1:R82ZRExE/nheo0N+T8zHPcLRTcH8MGsnR3BiVGX0TwI=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.68.6 h1:0LPJjbSNEDHidGOXa0LfvSVbdn9/GdlJUQTgE0kFpso=
@@ -28,5 +36,5 @@ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 h1:+1Kl1zx6bWi4X7cKi3VYh29
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21/go.mod h1:4vIRDq+CJB2xFAXZ+YgGUTiEft7oAQlhIs71xcSeuVg=
 github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 h1:F/M5Y9I3nwr2IEpshZgh1GeHpOItExNM9L1euNuh/fk=
 github.com/aws/aws-sdk-go-v2/service/sts v1.42.1/go.mod h1:mTNxImtovCOEEuD65mKW7DCsL+2gjEH+RPEAexAzAio=
-github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
-github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY=
+github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=

.github/actions/aws-test-infra/src/main.go

@@ -48,6 +48,12 @@ func run(ctx context.Context, stderr io.Writer, args []string) error {
 		return runProvision(ctx, logger, args[0]+" provision", args[2:])
 	case "cleanup":
 		return runCleanup(ctx, logger, args[0]+" cleanup", args[2:])
+	case "s3-stage":
+		return runS3Stage(ctx, logger, args[0]+" s3-stage", args[2:])
+	case "s3-download":
+		return runS3Download(ctx, logger, args[0]+" s3-download", args[2:])
+	case "s3-cleanup":
+		return runS3Cleanup(ctx, logger, args[0]+" s3-cleanup", args[2:])
 	case "-h", "--help", "help":
 		printUsage(stderr)
 		return nil
@@ -61,8 +67,11 @@ func printUsage(w io.Writer) {
 	fmt.Fprintln(w, `Usage: aws-test-infra <subcommand> [flags]
 
 Subcommands:
-  provision   Create VPC, subnet, IGW, route table, security group, and EC2 instances
-  cleanup     Tear down resources by ID and run a tag-based fallback sweep
+  provision     Create VPC, subnet, IGW, route table, security group, and EC2 instances
+  cleanup       Tear down resources by ID and run a tag-based fallback sweep
+  s3-stage      Ensure+tag an S3 bucket, upload artifacts, and emit presigned URLs
+  s3-download   Download an object to a local path (no-op if the object is absent)
+  s3-cleanup    Empty and delete an S3 bucket, with a tag-based fallback sweep
 
 Run "aws-test-infra <subcommand> -h" for subcommand flags.`)
 }

.github/actions/aws-test-infra/src/output.go

@@ -41,18 +41,11 @@ func emitOutput(logger *slog.Logger, destination, format string, ids ResourceIDs
 		}
 	}
 
-	var w io.Writer
-	if destination == "" {
-		w = os.Stdout
-	} else {
-		// GITHUB_OUTPUT / GITHUB_ENV are append-mode files per Actions docs.
-		f, err := os.OpenFile(destination, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
-		if err != nil {
-			return fmt.Errorf("open output destination %q: %w", destination, err)
-		}
-		defer f.Close()
-		w = f
+	w, err := openDestWriter(destination)
+	if err != nil {
+		return err
 	}
+	defer w.Close()
 
 	switch format {
 	case "json":
@@ -80,6 +73,26 @@ func destinationLabel(d string) string {
 	return d
 }
 
+// openDestWriter returns the writer for an output destination: os.Stdout (with
+// a no-op Close) when empty, otherwise the append-opened file. GITHUB_OUTPUT /
+// GITHUB_ENV are append-mode files per the Actions docs.
+func openDestWriter(destination string) (io.WriteCloser, error) {
+	if destination == "" {
+		return nopWriteCloser{os.Stdout}, nil
+	}
+	f, err := os.OpenFile(destination, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		return nil, fmt.Errorf("open output destination %q: %w", destination, err)
+	}
+	return f, nil
+}
+
+// nopWriteCloser adds a no-op Close to a Writer so callers can always defer
+// Close without special-casing os.Stdout.
+type nopWriteCloser struct{ io.Writer }
+
+func (nopWriteCloser) Close() error { return nil }
+
 func writeKeyValuePairs(w io.Writer, ids ResourceIDs) error {
 	pairs := []struct {
 		k, v string

.github/actions/aws-test-infra/src/parse-list.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Turn a newline-separated list on stdin into repeatable CLI flags.
+#
+# Usage: parse-list.sh <flag-name> < list
+#
+# Prints one "<flag-name>=<value>" per non-empty line, stripping surrounding
+# whitespace and any trailing CR (CRLF-origin YAML). Values may contain spaces,
+# '=', or ':'. Used by the s3-stage step to build the -upload / -presign flags
+# for the aws-test-infra binary; kept as a script (not inline YAML) so it can be
+# unit-tested with bats.
+set -euo pipefail
+
+flag="${1:?flag name required (e.g. -upload)}"
+
+while IFS= read -r line || [ -n "$line" ]; do
+  line="${line%$'\r'}"                    # strip trailing CR (CRLF input)
+  line="${line#"${line%%[![:space:]]*}"}" # trim leading whitespace
+  line="${line%"${line##*[![:space:]]}"}" # trim trailing whitespace
+  [ -z "$line" ] && continue
+  printf '%s=%s\n' "$flag" "$line"
+done