chore(ci): Remove cci-export and the bash-wrapper mechanism

[davdhacs]

waiting on removal of cci-export usage from stackrox/stackrox: stackrox/stackrox#22357

---

Remove cci-export and the entire bash-wrapper mechanism from the CI images.

Why

cci-export persisted environment variables across CircleCI steps by appending export lines to $BASH_ENV, which CircleCI sources before each step's shell. StackRox CI now runs on GitHub Actions and OpenShift CI / prow, where BASH_ENV is never sourced between steps — cross-step state travels via $GITHUB_ENV and $SHARED_DIR(prow) instead. The mechanism is dead weight.

It surfaced recently causing hundreds of noise warnings in our prow e2e logs: https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/83406/rehearse-83406-pull-ci-stackrox-stackrox-master-ocp-4-12-compliance-e2e-tests/2088023413737132032#1:build-log.txt%3A1491

INFO[2026-08-14T01:18:26Z] /bin/real-bash: /etc/initial-bash.env: Permission denied
/bin/real-bash: /etc/initial-bash.env: Permission denied
/bin/real-bash: /etc/initial-bash.env: Permission denied
/bin/real-bash: /etc/initial-bash.env: Permission denied
INFO: Thu Aug 13 23:56:25 UTC 2026: BEGIN OpenShift CI mods

Consumer impact

Verified across stackrox/{stackrox,scanner,collector}, automation-flavors, and an org-wide code search (including release-4.9/release-4.10):

• stackrox and scanner call cci-export behind a command -v cci-export guard and fall back to plain export (+ $GITHUB_ENV in stackrox's ci_export). This change degrades gracefully rather than breaking their CI.
• collector and automation-flavors don't reference it at all; automation-flavors passes cluster info / kubeconfig via $SHARED_DIR, which is independent of cci-export.
• Release branches pin older image tags, so they keep the existing behavior until they explicitly bump (and cci-export is not needed across 4.9,4.10,4.11 versions).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: ec9a37a4-c6fa-4b63-99eb-a4cab7871d9d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Build Images

Image Flavor	Image Tag
jenkins-plugin	quay.io/stackrox-io/apollo-ci:jenkins-plugin-0.5.14-1-g9bed4c4911
scanner-build	quay.io/stackrox-io/apollo-ci:scanner-build-0.5.14-1-g9bed4c4911
scanner-test	quay.io/stackrox-io/apollo-ci:scanner-test-0.5.14-1-g9bed4c4911
stackrox-build	quay.io/stackrox-io/apollo-ci:stackrox-build-0.5.14-1-g9bed4c4911
stackrox-test	quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.14-1-g9bed4c4911
stackrox-ui-test	quay.io/stackrox-io/apollo-ci:stackrox-ui-test-0.5.14-1-g9bed4c4911

[porridge]

@davdhacs this is a great cleanup. ❤️ However there might be subtle side-effects that this code hints at. Namely:

scripts/ci/lib.sh:    if command -v cci-export >/dev/null; then
scripts/ci/lib.sh:        # cci-export writes to $BASH_ENV which defaults to read-only /etc/initial-bash.env in the CI container
scripts/ci/lib.sh-        if [[ -n "${BASH_ENV:-}" && ! -w "${BASH_ENV}" ]]; then
scripts/ci/lib.sh-            BASH_ENV=$(mktemp)
scripts/ci/lib.sh-            export BASH_ENV
scripts/ci/lib.sh-        fi
scripts/ci/lib.sh:        cci-export "$env_name" "$env_value"
scripts/ci/lib.sh-    else
scripts/ci/lib.sh-        export "$env_name"="$env_value"
scripts/ci/lib.sh-    fi

If cci-export exists, then the current shell's set of variables is intact. Only subprocesses are affected. After this change is picked up, the builtin export runs, which causes a variable to be declared in scope of this current shell. This might cause subtle changes in behaviour.

I think we need to replace the above block in scripts/ci/lib.sh first and make sure it does not break anything (nightlies etc), before merging this PR.

[davdhacs]

I think we need to replace the above block in scripts/ci/lib.sh first and make sure it does not break anything (nightlies etc), before merging this PR.

Thank you for pointing out flipping this. Removing the usage first is persuasive to me because I had not considered cci-export may exist for some use case.