CrunchyData · cbandy · Jul 23, 2025 · Jul 23, 2025
diff --git a/internal/patroni/config_test.go b/internal/patroni/config_test.go
@@ -794,7 +794,7 @@ func TestPGBackRestCreateReplicaCommand(t *testing.T) {
 		file := filepath.Join(dir, "command.sh")
 		assert.NilError(t, os.WriteFile(file, []byte(command), 0o600))
 
-		cmd := exec.Command(shellcheck, "--enable=all", "--shell=sh", file)
+		cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", "--shell=sh", file)
 		output, err := cmd.CombinedOutput()
 		assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 	}
@@ -816,7 +816,7 @@ func TestPGBackRestCreateReplicaCommand(t *testing.T) {
 		file := filepath.Join(dir, "script.bash")
 		assert.NilError(t, os.WriteFile(file, []byte(script), 0o600))
 
-		cmd := exec.Command(shellcheck, "--enable=all", file)
+		cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", file)
 		output, err := cmd.CombinedOutput()
 		assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 	}

diff --git a/internal/pgadmin/config_test.go b/internal/pgadmin/config_test.go
@@ -77,7 +77,7 @@ func TestStartupCommand(t *testing.T) {
 		assert.NilError(t, os.WriteFile(file, []byte(command[3]), 0o600))
 
 		// Expect shellcheck to be happy.
-		cmd := exec.Command(shellcheck, "--enable=all", file)
+		cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", file)
 		output, err := cmd.CombinedOutput()
 		assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 	})
@@ -94,7 +94,7 @@ func TestStartupCommand(t *testing.T) {
 		// Expect flake8 to be happy. Ignore "E401 multiple imports on one line"
 		// in addition to the defaults. The file contents appear in PodSpec, so
 		// allow lines longer than the default to save some vertical space.
-		cmd := exec.Command(flake8, "--extend-ignore=E401", "--max-line-length=99", file)
+		cmd := exec.CommandContext(t.Context(), flake8, "--extend-ignore=E401", "--max-line-length=99", file)
 		output, err := cmd.CombinedOutput()
 		assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 	})

diff --git a/internal/pgadmin/users_test.go b/internal/pgadmin/users_test.go
@@ -180,7 +180,7 @@ with create_app().app_context():
 
 			// Expect flake8 to be happy. Ignore "E402 module level import not
 			// at top of file" in addition to the defaults.
-			cmd := exec.Command(flake8, "--extend-ignore=E402", file)
+			cmd := exec.CommandContext(t.Context(), flake8, "--extend-ignore=E402", file)
 			output, err := cmd.CombinedOutput()
 			assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 

diff --git a/internal/pgbackrest/config_test.go b/internal/pgbackrest/config_test.go
@@ -580,7 +580,7 @@ func TestReloadCommand(t *testing.T) {
 	assert.NilError(t, os.WriteFile(file, []byte(command[3]), 0o600))
 
 	// Expect shellcheck to be happy.
-	cmd := exec.Command(shellcheck, "--enable=all", file)
+	cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", file)
 	output, err := cmd.CombinedOutput()
 	assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 }
@@ -606,7 +606,7 @@ func TestRestoreCommand(t *testing.T) {
 	file := filepath.Join(dir, "script.bash")
 	assert.NilError(t, os.WriteFile(file, []byte(command[3]), 0o600))
 
-	cmd := exec.Command(shellcheck, "--enable=all", file)
+	cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", file)
 	output, err := cmd.CombinedOutput()
 	assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 }
@@ -645,7 +645,7 @@ func TestDedicatedSnapshotVolumeRestoreCommand(t *testing.T) {
 	file := filepath.Join(dir, "script.bash")
 	assert.NilError(t, os.WriteFile(file, []byte(command[3]), 0o600))
 
-	cmd := exec.Command(shellcheck, "--enable=all", file)
+	cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", file)
 	output, err := cmd.CombinedOutput()
 	assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 }

diff --git a/internal/pgbackrest/pgbackrest_test.go b/internal/pgbackrest/pgbackrest_test.go
@@ -92,7 +92,7 @@ fi
 	assert.NilError(t, os.WriteFile(file, []byte(shellCheckScript), 0o600))
 
 	// Expect shellcheck to be happy.
-	cmd := exec.Command(shellcheck, "--enable=all", file)
+	cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", file)
 	output, err := cmd.CombinedOutput()
 	assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 }
diff --git a/internal/pgbouncer/config_test.go b/internal/pgbouncer/config_test.go
@@ -216,7 +216,7 @@ func TestReloadCommand(t *testing.T) {
 	assert.NilError(t, os.WriteFile(file, []byte(command[3]), 0o600))
 
 	// Expect shellcheck to be happy.
-	cmd := exec.Command(shellcheck, "--enable=all", file)
+	cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", file)
 	output, err := cmd.CombinedOutput()
 	assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 }
diff --git a/internal/pki/encoding_test.go b/internal/pki/encoding_test.go
@@ -81,7 +81,7 @@ func TestCertificateTextMarshaling(t *testing.T) {
 		assert.NilError(t, os.WriteFile(certFile, certBytes, 0o600))
 
 		// The "openssl x509" command parses X.509 certificates.
-		cmd := exec.Command(openssl, "x509",
+		cmd := exec.CommandContext(t.Context(), openssl, "x509",
 			"-in", certFile, "-inform", "PEM", "-noout", "-text")
 
 		output, err := cmd.CombinedOutput()
@@ -153,7 +153,7 @@ func TestPrivateKeyTextMarshaling(t *testing.T) {
 		assert.NilError(t, os.WriteFile(keyFile, keyBytes, 0o600))
 
 		// The "openssl pkey" command processes public and private keys.
-		cmd := exec.Command(openssl, "pkey",
+		cmd := exec.CommandContext(t.Context(), openssl, "pkey",
 			"-in", keyFile, "-inform", "PEM", "-noout", "-text")
 
 		output, err := cmd.CombinedOutput()
@@ -164,12 +164,12 @@ func TestPrivateKeyTextMarshaling(t *testing.T) {
 			"expected valid private key, got:\n%s", output)
 
 		t.Run("Check", func(t *testing.T) {
-			output, _ := exec.Command(openssl, "pkey", "-help").CombinedOutput()
+			output, _ := exec.CommandContext(t.Context(), openssl, "pkey", "-help").CombinedOutput()
 			if !strings.Contains(string(output), "-check") {
 				t.Skip(`requires "-check" flag`)
 			}
 
-			cmd := exec.Command(openssl, "pkey",
+			cmd := exec.CommandContext(t.Context(), openssl, "pkey",
 				"-check", "-in", keyFile, "-inform", "PEM", "-noout", "-text")
 
 			output, err := cmd.CombinedOutput()

diff --git a/internal/pki/pki_test.go b/internal/pki/pki_test.go
@@ -439,7 +439,7 @@ func basicOpenSSLVerify(t *testing.T, openssl string, root, leaf Certificate) {
 	verify := func(t testing.TB, args ...string) {
 		t.Helper()
 		// #nosec G204 -- args from this test
-		cmd := exec.Command(openssl, append([]string{"verify"}, args...)...)
+		cmd := exec.CommandContext(t.Context(), openssl, append([]string{"verify"}, args...)...)
 
 		output, err := cmd.CombinedOutput()
 		assert.NilError(t, err, "%q\n%s", cmd.Args, output)
@@ -476,7 +476,7 @@ func basicOpenSSLVerify(t *testing.T, openssl string, root, leaf Certificate) {
 }
 
 func strictOpenSSLVerify(t *testing.T, openssl string, root, leaf Certificate) {
-	output, _ := exec.Command(openssl, "verify", "-help").CombinedOutput()
+	output, _ := exec.CommandContext(t.Context(), openssl, "verify", "-help").CombinedOutput()
 	if !strings.Contains(string(output), "-x509_strict") {
 		t.Skip(`requires "-x509_strict" flag`)
 	}
@@ -487,7 +487,7 @@ func strictOpenSSLVerify(t *testing.T, openssl string, root, leaf Certificate) {
 	verify := func(t testing.TB, args ...string) {
 		t.Helper()
 		// #nosec G204 -- args from this test
-		cmd := exec.Command(openssl, append([]string{"verify",
+		cmd := exec.CommandContext(t.Context(), openssl, append([]string{"verify",
 			// Do not use the default trusted CAs.
 			"-no-CAfile", "-no-CApath",
 			// Disable "non-compliant workarounds for broken certificates".

diff --git a/internal/postgres/config_test.go b/internal/postgres/config_test.go
@@ -52,7 +52,7 @@ func TestWALDirectory(t *testing.T) {
 
 func TestBashHalt(t *testing.T) {
 	t.Run("NoPipeline", func(t *testing.T) {
-		cmd := exec.Command("bash")
+		cmd := exec.CommandContext(t.Context(), "bash")
 		cmd.Args = append(cmd.Args, "-c", "--", bashHalt+`; halt ab cd e`)
 
 		var exit *exec.ExitError
@@ -64,7 +64,7 @@ func TestBashHalt(t *testing.T) {
 	})
 
 	t.Run("PipelineZeroStatus", func(t *testing.T) {
-		cmd := exec.Command("bash")
+		cmd := exec.CommandContext(t.Context(), "bash")
 		cmd.Args = append(cmd.Args, "-c", "--", bashHalt+`; true && halt message`)
 
 		var exit *exec.ExitError
@@ -76,7 +76,7 @@ func TestBashHalt(t *testing.T) {
 	})
 
 	t.Run("PipelineNonZeroStatus", func(t *testing.T) {
-		cmd := exec.Command("bash")
+		cmd := exec.CommandContext(t.Context(), "bash")
 		cmd.Args = append(cmd.Args, "-c", "--", bashHalt+`; (exit 99) || halt $'multi\nline'`)
 
 		var exit *exec.ExitError
@@ -88,7 +88,7 @@ func TestBashHalt(t *testing.T) {
 	})
 
 	t.Run("Subshell", func(t *testing.T) {
-		cmd := exec.Command("bash")
+		cmd := exec.CommandContext(t.Context(), "bash")
 		cmd.Args = append(cmd.Args, "-c", "--", bashHalt+`; (halt 'err') || echo 'after'`)
 
 		stderr := new(bytes.Buffer)
@@ -104,7 +104,7 @@ func TestBashHalt(t *testing.T) {
 
 func TestBashPermissions(t *testing.T) {
 	// macOS `stat` takes different arguments than BusyBox and GNU coreutils.
-	if output, err := exec.Command("stat", "--help").CombinedOutput(); err != nil {
+	if output, err := exec.CommandContext(t.Context(), "stat", "--help").CombinedOutput(); err != nil {
 		t.Skip(`requires "stat" executable`)
 	} else if !strings.Contains(string(output), "%A") {
 		t.Skip(`requires "stat" with access format sequence`)
@@ -116,7 +116,7 @@ func TestBashPermissions(t *testing.T) {
 	assert.NilError(t, os.WriteFile(filepath.Join(dir, "sub", "fn"), nil, 0o624)) // #nosec G306 OK permissions for a temp dir in a test
 	assert.NilError(t, os.Chmod(filepath.Join(dir, "sub", "fn"), 0o624))
 
-	cmd := exec.Command("bash")
+	cmd := exec.CommandContext(t.Context(), "bash")
 	cmd.Args = append(cmd.Args, "-c", "--",
 		bashPermissions+`; permissions "$@"`, "-",
 		filepath.Join(dir, "sub", "fn"))
@@ -131,7 +131,7 @@ func TestBashPermissions(t *testing.T) {
 
 func TestBashRecreateDirectory(t *testing.T) {
 	// macOS `stat` takes different arguments than BusyBox and GNU coreutils.
-	if output, err := exec.Command("stat", "--help").CombinedOutput(); err != nil {
+	if output, err := exec.CommandContext(t.Context(), "stat", "--help").CombinedOutput(); err != nil {
 		t.Skip(`requires "stat" executable`)
 	} else if !strings.Contains(string(output), "%a") {
 		t.Skip(`requires "stat" with access format sequence`)
@@ -143,7 +143,7 @@ func TestBashRecreateDirectory(t *testing.T) {
 	assert.NilError(t, os.WriteFile(filepath.Join(dir, "d", "file"), nil, 0o644))    // #nosec G306 OK permissions for a temp dir in a test
 
 	stat := func(args ...string) string {
-		cmd := exec.Command("stat", "-c", "%i %#a %N")
+		cmd := exec.CommandContext(t.Context(), "stat", "-c", "%i %#a %N")
 		cmd.Args = append(cmd.Args, args...)
 		out, err := cmd.CombinedOutput()
 
@@ -160,7 +160,7 @@ func TestBashRecreateDirectory(t *testing.T) {
 		filepath.Join(dir, "d", "file"),
 	)
 
-	cmd := exec.Command("bash")
+	cmd := exec.CommandContext(t.Context(), "bash")
 	cmd.Args = append(cmd.Args, "-ceu", "--",
 		bashRecreateDirectory+` recreate "$@"`, "-",
 		filepath.Join(dir, "d"), "0740")
@@ -199,15 +199,15 @@ func TestBashRecreateDirectory(t *testing.T) {
 
 func TestBashSafeLink(t *testing.T) {
 	// macOS `mv` takes different arguments than GNU coreutils.
-	if output, err := exec.Command("mv", "--help").CombinedOutput(); err != nil {
+	if output, err := exec.CommandContext(t.Context(), "mv", "--help").CombinedOutput(); err != nil {
 		t.Skip(`requires "mv" executable`)
 	} else if !strings.Contains(string(output), "no-target-directory") {
 		t.Skip(`requires "mv" that overwrites a directory symlink`)
 	}
 
 	// execute calls the bash function with args.
 	execute := func(args ...string) (string, error) {
-		cmd := exec.Command("bash")
+		cmd := exec.CommandContext(t.Context(), "bash")
 		cmd.Args = append(cmd.Args, "-ceu", "--", bashSafeLink+`safelink "$@"`, "-")
 		cmd.Args = append(cmd.Args, args...)
 		output, err := cmd.CombinedOutput()
@@ -474,7 +474,7 @@ func TestStartupCommand(t *testing.T) {
 	assert.NilError(t, os.WriteFile(file, []byte(script), 0o600))
 
 	// Expect shellcheck to be happy.
-	cmd := exec.Command(shellcheck, "--enable=all", file)
+	cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", file)
 	output, err := cmd.CombinedOutput()
 	assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 

diff --git a/internal/postgres/exec_test.go b/internal/postgres/exec_test.go
@@ -184,7 +184,7 @@ done <<< "${databases}"
 			assert.NilError(t, os.WriteFile(file, []byte(script), 0o600))
 
 			// Expect shellcheck to be happy.
-			cmd := exec.Command(shellcheck, "--enable=all", file)
+			cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", file)
 			output, err := cmd.CombinedOutput()
 			assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 

diff --git a/internal/shell/paths_test.go b/internal/shell/paths_test.go
@@ -76,7 +76,7 @@ func TestMakeDirectories(t *testing.T) {
 
 			// Expect ShellCheck for "sh" to be happy.
 			// - https://www.shellcheck.net/wiki/SC2148
-			cmd := exec.Command(shellcheck, "--enable=all", "--shell=sh", file)
+			cmd := exec.CommandContext(t.Context(), shellcheck, "--enable=all", "--shell=sh", file)
 			output, err := cmd.CombinedOutput()
 			assert.NilError(t, err, "%q\n%s", cmd.Args, output)
 		})

diff --git a/internal/testing/require/exec.go b/internal/testing/require/exec.go
@@ -38,7 +38,7 @@ func executable(name string, args ...string) func(testing.TB) string {
 		t.Helper()
 		once.Do(func() {
 			path, err := exec.LookPath(name)
-			cmd := exec.Command(path, args...) // #nosec G204 -- args from init()
+			cmd := exec.CommandContext(t.Context(), path, args...) // #nosec G204 -- args from init()
 
 			if err != nil {
 				result = func(t testing.TB) string {