Description:

In command/connect/envoy/pipe-bootstrap/connect_envoy_pipe-bootstrap.go, function Run, a file descriptor opened via:

f, err := os.OpenFile(args[0], os.O_WRONLY|os.O_APPEND, 0700)

can be leaked on an error path.

If buf.WriteTo(f) fails, the function returns:

return 1

before calling f.Close().

The success path correctly calls f.Close() (around line 70), but on the error path the descriptor remains open.

This results in a file descriptor leak when buf.WriteTo returns an error.

Expected behavior:

The file descriptor should be closed on all return paths.

A minimal fix would be:

f.Close()
return 1

or alternatively register defer f.Close() immediately after the successful os.OpenFile.

Happy to submit a minimal PR if helpful.