From 397dd4674e4612148d887db5b848972d513ac519 Mon Sep 17 00:00:00 2001
From: Hiroyuki Sato <hiroysato@gmail.com>
Date: Tue, 4 Aug 2026 11:17:43 +0900
Subject: [PATCH 1/3] GH-50796: [CI][Dev] Fix shellcheck errors in the
 ci/scripts/r_valgrind.sh

---
 .pre-commit-config.yaml  |  1 +
 ci/scripts/r_valgrind.sh | 14 +++++++-------
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 052eb8c7c20..3cd67845cb5 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -345,6 +345,7 @@ repos:
           ?^ci/scripts/r_revdepcheck\.sh$|
           ?^ci/scripts/r_sanitize\.sh$|
           ?^ci/scripts/r_test\.sh$|
+          ?^ci/scripts/r_valgrind\.sh$|
           ?^ci/scripts/release_test\.sh$|
           ?^ci/scripts/ruby_test\.sh$|
           ?^ci/scripts/rust_build\.sh$|
diff --git a/ci/scripts/r_valgrind.sh b/ci/scripts/r_valgrind.sh
index 0e40d792111..2ffb3161054 100755
--- a/ci/scripts/r_valgrind.sh
+++ b/ci/scripts/r_valgrind.sh
@@ -18,28 +18,28 @@
 
 set -ex
 
-: ${R_BIN:=RDvalgrind}
+: "${R_BIN:=RDvalgrind}"
 
-source_dir=${1}/r
+source_dir="${1}/r"
 
 export CMAKE_BUILD_TYPE=RelWithDebInfo
 
-pushd ${source_dir}
+pushd "${source_dir}"
 
 # build first so that any stray compiled files in r/src are ignored
-${R_BIN} CMD build --no-build-vignettes .
-${R_BIN} CMD INSTALL ${INSTALL_ARGS} arrow*.tar.gz
+"${R_BIN}" CMD build --no-build-vignettes .
+"${R_BIN}" CMD INSTALL "${INSTALL_ARGS}" arrow*.tar.gz
 
 pushd tests
 
 # to generate suppression files run:
 # ${R_BIN} --vanilla -d "valgrind --tool=memcheck --leak-check=full --track-origins=yes --gen-suppressions=all --log-file=memcheck.log" -f testthat.R
-${R_BIN} --vanilla -d "valgrind --tool=memcheck --leak-check=full --track-origins=yes --suppressions=/${1}/ci/etc/valgrind-cran.supp" -f testthat.R |& tee testthat.out
+"${R_BIN}" --vanilla -d "valgrind --tool=memcheck --leak-check=full --track-origins=yes --suppressions=/${1}/ci/etc/valgrind-cran.supp" -f testthat.R |& tee testthat.out
 
 # valgrind --error-exitcode=1 should return an erroring exit code that we can catch,
 # but R eats that and returns 0, so we need to look at the output and make sure that
 # we have 0 errors instead.
-if [ $(grep -c "ERROR SUMMARY: 0 errors" testthat.out) != 1 ]; then
+if [ "$(grep -c "ERROR SUMMARY: 0 errors" testthat.out)" -ne 1 ]; then
   cat testthat.out
   echo "Found Valgrind errors"
   exit 1

From a41f6ca65ea2ae5fe77427174b4391114be1f299 Mon Sep 17 00:00:00 2001
From: Hiroyuki Sato <hiroysato@gmail.com>
Date: Tue, 4 Aug 2026 13:17:08 +0900
Subject: [PATCH 2/3] GH-50796: [CI][Dev] Fix shellcheck errors in the
 ci/scripts/r_valgrind.sh

---
 ci/scripts/r_valgrind.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ci/scripts/r_valgrind.sh b/ci/scripts/r_valgrind.sh
index 2ffb3161054..aff60e0a9c1 100755
--- a/ci/scripts/r_valgrind.sh
+++ b/ci/scripts/r_valgrind.sh
@@ -26,9 +26,13 @@ export CMAKE_BUILD_TYPE=RelWithDebInfo
 
 pushd "${source_dir}"
 
+# Convert the space-separated options into a Bash array.
+# This avoids ShellCheck SC2086 and preserves argument boundaries.
+read -r -a R_INSTALL_ARGS <<< "${INSTALL_ARGS:-}"
+
 # build first so that any stray compiled files in r/src are ignored
 "${R_BIN}" CMD build --no-build-vignettes .
-"${R_BIN}" CMD INSTALL "${INSTALL_ARGS}" arrow*.tar.gz
+"${R_BIN}" CMD INSTALL "${R_INSTALL_ARGS[@]}" arrow*.tar.gz
 
 pushd tests
 

From 3c3e5779ac2a0177b4c578d787d18c48fcb9fb38 Mon Sep 17 00:00:00 2001
From: Hiroyuki Sato <hiroysato@gmail.com>
Date: Wed, 5 Aug 2026 09:15:49 +0900
Subject: [PATCH 3/3] Update ci/scripts/r_valgrind.sh

Co-authored-by: Sutou Kouhei <kou@cozmixng.org>
---
 ci/scripts/r_valgrind.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/scripts/r_valgrind.sh b/ci/scripts/r_valgrind.sh
index aff60e0a9c1..63a66532ea0 100755
--- a/ci/scripts/r_valgrind.sh
+++ b/ci/scripts/r_valgrind.sh
@@ -43,7 +43,7 @@ pushd tests
 # valgrind --error-exitcode=1 should return an erroring exit code that we can catch,
 # but R eats that and returns 0, so we need to look at the output and make sure that
 # we have 0 errors instead.
-if [ "$(grep -c "ERROR SUMMARY: 0 errors" testthat.out)" -ne 1 ]; then
+if ! grep -q "ERROR SUMMARY: 0 errors" testthat.out; then
   cat testthat.out
   echo "Found Valgrind errors"
   exit 1