fix(scripts): detect failures in publish_bottlecap_sandbox.sh

[lucaspimentel]

Overview

publish_bottlecap_sandbox.sh would print

DONE: Published version  of layer ...

even when the aws-vault/aws call failed, because pipeline failures were not propagated and NEW_VERSION was silently empty.

Changes:

• Replace set -e with set -eo pipefail so any failure in the aws-vault | jq pipeline aborts the script immediately
• Add explicit validation: if NEW_VERSION is empty or null after the publish call, print ERROR: and exit 1 instead of a misleading success message
• Fix unquoted $ARCHITECTURE, $REGION variables (shellcheck warnings)

Testing

Verified locally by running the script without aws in $PATH — the script now exits with ERROR: Failed to publish layer ... instead of DONE: Published version of layer ....

[Copilot]

Pull request overview

Improves reliability of the scripts/publish_bottlecap_sandbox.sh publishing flow by preventing misleading “DONE” output when the AWS publish pipeline fails or returns an invalid version.

Changes:

• Enable pipeline failure detection via set -eo pipefail.
• Validate NEW_VERSION and fail fast with an explicit ERROR: when publish output is empty/null.
• Quote $ARCHITECTURE/$REGION usages to avoid shell parsing issues.

[Copilot]

In _init_arg, the defaulting of ARCHITECTURE to amd64 happens after the logic that sets LAYER_PATH/LAYER_NAME based on ARCHITECTURE. When ARCHITECTURE is unset/empty, this will leave LAYER_PATH and LAYER_NAME empty even though the script prints that it’s defaulting to amd64. Consider defaulting ARCHITECTURE first (or using a single case with a default branch) so the layer path/name are always initialized consistently.

[lucaspimentel]

thanks, but that's out of scope for this PR