CP-14167 - Make scheduled rake runner shell-safe on Alpine

What
Hardens the one-shot rake task runner so it works under Alpine’s /bin/sh (busybox ash), not just bash. AWS CLI detection and Secrets Manager fetches now fail cleanly with portable redirects and explicit error handling.

Why
The webhook health check runs as a scheduled ECS task via this script. Bash-isms (&>) and dead $? checks under set -e could mis-handle errors on Alpine, so the periodic integrity check needs a portable, fail-closed startup path.

How to test
• sh -n bin/run_rake_task (syntax check)
• Review that command -v aws uses >/dev/null 2>&1 and aws fetches use if ! VAR=$(aws ...); then
• On staging after deploy: EventBridge/ECS one-shot still loads secrets and runs careerplug:check_webhooks

Author: bernardodsanderson

bin/run_rake_task

@@ -14,6 +14,8 @@
 #
 # Migrations are intentionally NOT run here: the app service migrates on deploy,
 # and a periodic one-shot shouldn't race with it.
+#
+# POSIX sh only (Alpine /bin/sh is busybox ash, not bash): no bash-isms like &>.
 
 RAKE_TASK="${1:-}"
 if [ -z "$RAKE_TASK" ]; then
@@ -41,7 +43,7 @@ check_aws_setup() {
         exit 1
     fi
 
-    if ! command -v aws &> /dev/null; then
+    if ! command -v aws >/dev/null 2>&1; then
         echo "ERROR: AWS CLI is not installed. Please install it to proceed."
         exit 1
     fi
@@ -55,13 +57,11 @@ fetch_db_credentials() {
         exit 1
     fi
 
-    SECRET_JSON=$(aws secretsmanager get-secret-value \
+    if ! SECRET_JSON=$(aws secretsmanager get-secret-value \
         --region "$AWS_REGION" \
         --secret-id "$DB_SECRETS_NAME" \
         --query SecretString \
-        --output text)
-
-    if [ $? -ne 0 ]; then
+        --output text); then
         echo "ERROR: Failed to retrieve secrets from AWS Secrets Manager"
         exit 1
     fi
@@ -90,13 +90,16 @@ fetch_encryption_key() {
 
     ENCRYPTION_SECRET_NAME="cpdocuseal/encryption_key"
 
-    ENCRYPTION_KEY=$(aws secretsmanager get-secret-value \
+    if ! ENCRYPTION_KEY=$(aws secretsmanager get-secret-value \
         --region "$AWS_REGION" \
         --secret-id "$ENCRYPTION_SECRET_NAME" \
         --query SecretString \
-        --output text)
+        --output text); then
+        echo "ERROR: Failed to retrieve encryption key from AWS Secrets Manager"
+        exit 1
+    fi
 
-    if [ $? -ne 0 ] || [ -z "$ENCRYPTION_KEY" ] || [ "$ENCRYPTION_KEY" = "null" ]; then
+    if [ -z "$ENCRYPTION_KEY" ] || [ "$ENCRYPTION_KEY" = "null" ]; then
         echo "ERROR: Failed to retrieve encryption key from AWS Secrets Manager"
         exit 1
     fi
@@ -114,13 +117,11 @@ fetch_env_variables() {
         exit 1
     fi
 
-    SECRET_JSON=$(aws secretsmanager get-secret-value \
+    if ! SECRET_JSON=$(aws secretsmanager get-secret-value \
         --region "$AWS_REGION" \
         --secret-id "$CP_VARIABLES_NAME" \
         --query SecretString \
-        --output text)
-
-    if [ $? -ne 0 ]; then
+        --output text); then
         echo "ERROR: Failed to retrieve secrets from AWS Secrets Manager"
         exit 1
     fi