How would you write a robust, idempotent automation script?

A production script should be safe to re-run, fail clearly and clean up after itself.

#!/usr/bin/env bash
set -euo pipefail

workdir=$(mktemp -d)
cleanup() { rm -rf "$workdir"; }
trap cleanup EXIT ERR INT TERM

log() { printf '%s %s\n' "$(date -Is)" "$*" >&2; }

main() {
    if [[ $EUID -ne 0 ]]; then
        log "must run as root"
        exit 1
    fi
    mkdir -p /etc/myapp
    install -m 0644 config.toml /etc/myapp/config.toml
    systemctl is-active --quiet myapp || systemctl start myapp
    log "done"
}

main "$@"

Practices that matter: quote expansions, validate inputs and check tools with command -v, use mktemp for temporary files, and make actions idempotent by creating only what is missing and using install for exact permissions. Log to stderr, return meaningful exit codes, avoid unchecked cd, and document dry-run options.