From 0a8db75394cd7e26289779b088e2fa66acda1359 Mon Sep 17 00:00:00 2001
From: Zen Dodd <mail@steadytao.com>
Date: Sat, 10 Oct 2026 12:03:02 +1000
Subject: [PATCH] ci: pass Valgrind options safely

---
 .github/workflows/valgrind.yml           | 12 ++++++------
 testsuite/tests/workflow-profile_test.py |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/valgrind.yml b/.github/workflows/valgrind.yml
index 6321eacb..743306ec 100644
--- a/.github/workflows/valgrind.yml
+++ b/.github/workflows/valgrind.yml
@@ -73,14 +73,14 @@ jobs:
     - name: run testsuite under valgrind
       run: |
         mkdir -p test-results/valgrind-logs
-        SUDO=
-        [ "${{ matrix.privilege }}" = root ] && SUDO="sudo -E"
-        TCP=
-        [ "${{ matrix.transport }}" = tcp ] && TCP="--use-tcp --daemon-tests-only"
-        $SUDO env RSYNC_TEST_PROFILES=${{ matrix.profiles }} scratchbase="$VALGRIND_SCRATCH" \
+        SUDO=()
+        [ "${{ matrix.privilege }}" = root ] && SUDO=(sudo -E)
+        TCP=()
+        [ "${{ matrix.transport }}" = tcp ] && TCP=(--use-tcp --daemon-tests-only)
+        "${SUDO[@]}" env RSYNC_TEST_PROFILES=${{ matrix.profiles }} scratchbase="$VALGRIND_SCRATCH" \
           ./testsuite/runtests.py --valgrind \
           --valgrind-opts="--leak-check=no --error-exitcode=0" \
-          $TCP -j2 --timeout=600 --preserve-scratch \
+          "${TCP[@]}" -j2 --timeout=600 --preserve-scratch \
           --receipt=test-results/valgrind-${{ matrix.privilege }}-${{ matrix.transport }}.json
 
     - name: scan for unsuppressed valgrind errors
diff --git a/testsuite/tests/workflow-profile_test.py b/testsuite/tests/workflow-profile_test.py
index 7eeb2470..b58ecba8 100644
--- a/testsuite/tests/workflow-profile_test.py
+++ b/testsuite/tests/workflow-profile_test.py
@@ -131,7 +131,7 @@ for path in workflows:
         if ('VALGRIND_SCRATCH: /tmp/' not in workflow
                 or 'scratchbase="$VALGRIND_SCRATCH"' not in workflow):
             test_fail('valgrind.yml: scratch is not accessible after dropping privileges')
-        if 'TCP="--use-tcp --daemon-tests-only"' not in workflow:
+        if 'TCP=(--use-tcp --daemon-tests-only)' not in workflow:
             test_fail('valgrind.yml: TCP pass repeats transport-independent tests')
         if 'find testtmp' in workflow or 'testtmp/**/' in workflow:
             test_fail('valgrind.yml: evidence collection traverses test fixtures')