ci: pass Valgrind options safely

.github/workflows/valgrind.yml

@@ -73,14 +73,14 @@ jobs:
     - name: run testsuite under valgrind
       run: |
         mkdir -p test-results/valgrind-logs
-        SUDO=
-        [ "${{ matrix.privilege }}" = root ] && SUDO="sudo -E"
-        TCP=
-        [ "${{ matrix.transport }}" = tcp ] && TCP="--use-tcp --daemon-tests-only"
-        $SUDO env RSYNC_TEST_PROFILES=${{ matrix.profiles }} scratchbase="$VALGRIND_SCRATCH" \
+        SUDO=()
+        [ "${{ matrix.privilege }}" = root ] && SUDO=(sudo -E)
+        TCP=()
+        [ "${{ matrix.transport }}" = tcp ] && TCP=(--use-tcp --daemon-tests-only)
+        "${SUDO[@]}" env RSYNC_TEST_PROFILES=${{ matrix.profiles }} scratchbase="$VALGRIND_SCRATCH" \
           ./testsuite/runtests.py --valgrind \
           --valgrind-opts="--leak-check=no --error-exitcode=0" \
-          $TCP -j2 --timeout=600 --preserve-scratch \
+          "${TCP[@]}" -j2 --timeout=600 --preserve-scratch \
           --receipt=test-results/valgrind-${{ matrix.privilege }}-${{ matrix.transport }}.json
 
     - name: scan for unsuppressed valgrind errors

testsuite/tests/workflow-profile_test.py

@@ -131,7 +131,7 @@ for path in workflows:
         if ('VALGRIND_SCRATCH: /tmp/' not in workflow
                 or 'scratchbase="$VALGRIND_SCRATCH"' not in workflow):
             test_fail('valgrind.yml: scratch is not accessible after dropping privileges')
-        if 'TCP="--use-tcp --daemon-tests-only"' not in workflow:
+        if 'TCP=(--use-tcp --daemon-tests-only)' not in workflow:
             test_fail('valgrind.yml: TCP pass repeats transport-independent tests')
         if 'find testtmp' in workflow or 'testtmp/**/' in workflow:
             test_fail('valgrind.yml: evidence collection traverses test fixtures')