mirror of
https://github.com/Monkopedia/rouse-context.git
synced 2026-11-01 20:20:25 +00:00
0d15ef1914
`-o check-extra-masked-returns,check-set-e-suppressed` is now on in scripts/check-shell-lint.sh, in both phases: phase 1 passes the options to shellcheck directly, phase 2 hands them through actionlint to the same version-asserted binary, so the inline `run:` shell cannot drift to a weaker standard than the `*.sh` next to it. 27 sites were live on this base and each was decided on its own terms, not silenced: 19 restructured so the status is checked, 5 kept behind an explicit `|| true` and 3 behind a targeted `disable=`, every one of the 8 with a comment saying why the discarded status is genuinely uninteresting. In all 8 the masked command is the diagnostic half of a failure that has ALREADY been decided, and letting its status escape would kill the script between the header and the verdict -- the #628 shape. Three of the restructures were not cosmetic. Measured against the old code: * check-zombie-screens.sh with a stubbed-failing `awk` printed "OK: no zombie screens" and exited 0 over a tree containing one. It now names the file it could not read and fails. * deploy/deploy.sh with a stubbed-failing `du` printed "Binary size: ", scp'd the binary to production, restarted the unit and exited 0. It now stops with du's own reason, before the copy. * backfill-relay-secrets.sh printed "[set] NAME ( bytes)" for a file it could not read and let the failed `gh secret set` pass for a successful one. It now says "[fail] ... NOT pushed" and does not push. Every restructured gate was re-run against an input that must produce a finding, and the finding is still PRINTED rather than the gate dying first: check-apk-distribution.sh (three fixtures, byte-identical output, including the path where the diagnostic grep itself matches nothing and exits 1), check-roborazzi-step-order.sh, check-zombie-screens.sh, the release.yml changelog step (four fixtures) and the ci.yml diagnostic with no shellcheck on PATH. #678 is deliberately untouched: check-roborazzi-step-order.sh still exits 1 with zero bytes on a workflow with no `jobs:` key and on `jobs: {}`, before and after, byte for byte. Fixing it here would have buried it. The self-test grows from 21 to 26 cases: a red case for SC2312 and one for SC2310 (both clean at the default severity this gate used before, so a red is evidence the FLAG is on and not merely that the linter ran), a green case carrying the same two shapes with their statuses handled, and a red/green pair for phase 2 proving the options reach the inline `run:` shell. Mutation-tested: dropping `-o` from phase 1 fails exactly the two phase-1 reds, dropping it from the phase-2 command string fails exactly the phase-2 red, and both green twins stay green through both mutations. `-o all` stays off: 637 findings, and after this change 100% of them pure style (591 SC2250, 46 SC2292). Full gate suite green before and after -- 6 suites, 88 cases before, 93 after, the +5 all in check-shell-lint-test.sh. Closes #657 Claude-Session: https://claude.ai/code/session_01YYSPuh9bZEJkrzvnEpY1QK Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| deploy.sh | ||
| relay.service | ||
| relay.toml.production | ||
| setup-vps.sh | ||