hbs_renderer silently ignores os.WriteFile errors (stale/missing data-sources.xml)

[aaronbrethorst]

Summary

oba/config/template_renderer/main.go discards the error returned by os.WriteFile, so a failed config write produces a successful (exit 0) hbs_renderer run.

https://github.com/OneBusAway/docker/blob/main/oba/config/template_renderer/main.go#L66-L67

if *outputFile != "" {
    os.WriteFile(*outputFile, []byte(result), 0644)
}

Impact

bootstrap.sh calls hbs_renderer to write each data-sources.xml / context.xml from its .hbs template. If a write fails (read-only/missing destination directory, full disk, permissions), the renderer still exits 0, so bootstrap.sh proceeds as though the config were written.

Because bootstrap.sh runs as supervisord [program:start] and [program:tomcat] waits on start:exited, a non-zero exit here would correctly halt the boot. Instead, Tomcat can start against a stale or missing data-sources.xml with no error surfaced — a silent failure. Every other error path in this file already fails loudly via os.Exit(1); only the write is unchecked.

Suggested fix

Check the error and exit non-zero (matching the existing renderTemplate error handling at main.go:60-64):

if *outputFile != "" {
    if err := os.WriteFile(*outputFile, []byte(result), 0644); err != nil {
        fmt.Printf("Error writing output file: %v\n", err)
        os.Exit(1)
    }
}

Notes

• Pre-existing; not introduced by any recent change. Surfaced by review of PR Support multiple GTFS-RT feeds #130 (multi GTFS-RT feeds) but unrelated to that change, so it was left out of scope there.
• Low effort. A test could cover it by pointing -output at an unwritable path and asserting a non-zero exit, though the existing tests only exercise renderTemplate, not main.