SonarCloud: miscellaneous findings #1462

Activity

1. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   sonarcloud-auditSonarCloud audit finding (idempotent marker)SonarCloud audit finding (idempotent marker)

   priority:majorSonarCloud MAJOR severitySonarCloud MAJOR severity

   on Nov 3, 2026
2. don-petry commented on Nov 3, 2026

   

   don-petry

   on Nov 3, 2026

   ContributorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #1462 — SonarCloud: miscellaneous findings

   Scope

   Fix every shell:S7688 finding by converting [ … ] conditional tests to [[ … ]] in all tracked first-party bash scripts (scripts/**, .github/scripts/**). This is a refactor: behavior must not change. No NOSONAR.

   Approach

   The conversion is done with a parser, not regex: a small throwaway tool built on mvdan.cc/sh/v3/syntax (the shfmt parser). It rewrites only [ / ] words that sit in command position. Any [ inside strings, heredocs, regexes, awk/jq programs or [[:class:]] stays untouched. The tool also checks for constructs that mean something different inside [[ ]]:

   • -a/-o → &&/||; \( \) → ( )
   • an unquoted right-hand side of =/==/!= gets quoted, so it isn't treated as a glob pattern
   • string-ordering </> and unary -o are flagged for manual review
   • operands of -eq/-gt/… are reviewed, since [[ ]] evaluates them as arithmetic. Spot checks show these inputs are already checked to be integers (arl_sanitize_int, case *[!0-9]*, =~ ^[0-9]+$).

   Implementation Checklist

   • All 20 files listed in the issue
   • The other tracked .sh files with the same pattern (e.g. scripts/lib/agent-rate-limit.sh, scripts/lib/push-protection.sh, .github/scripts/feature-ideation/**, .github/scripts/pr-auto-review/**) so the rule really reaches zero
   • node_modules/ (vendored bats) excluded

   Tests to Write

   None. This is a behavior-preserving refactor (TDD exception). The full existing bats suite (tests/*.bats, test/**/*.bats) is the regression guard and is run before and after the change.

   Test Command

   bats --jobs 8 $(find tests test -name '*.bats') + bash .dev-lead/scripts/dev-lead-lint.sh + shellcheck --severity=warning -x on all changed files
3. don-petry commented on Nov 3, 2026

   

   don-petry

   on Nov 3, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Progress (in progress — not yet durable)

   Provisional. Nothing is pushed yet. The automation posts the authoritative completion record (with PR number + head SHA) after the push. Treat the notes below as intent, not delivered results.

   Plan Execution (intended)

   • [ … ] is converted to [[ … ]] across 63 tracked first-party bash scripts (scripts/**, .github/scripts/**), about 1.5k test expressions. Only test commands change; the vendored node_modules/bats is excluded.
   • The conversion uses a parser (mvdan.cc/sh/v3/syntax), not regex. Only [/] words in command position are rewritten, so [ inside strings, heredocs, regexes, awk/jq programs and [[:class:]] is untouched.
   • The tool checks for constructs that mean something different in [[ ]] and found none in this repo: no -a/-o, \(, \</\>, or glob/unquoted right-hand sides of =/!=. Integer-comparison operands were spot-checked: the ones fed by external input are checked upstream to be integers (arl_sanitize_int, case *[!0-9]*, =~ ^[0-9]+$).
   • No NOSONAR was added.

   Local check output (provisional — not the pushed run)

   • This workspace had the same bats results before and after the change. The only failures, in both runs, are 3 secret-scan tests that need gitleaks, which is not installed in this environment.
   • dev-lead-lint.sh and shellcheck --severity=warning -x on all changed files report no findings.

   Files touched (this workspace, not yet pushed)

   • 63 .sh files under scripts/ and .github/scripts/: conditional-syntax change only.

   Notes

   TDD exception: this is a behavior-preserving refactor, so no new tests. The existing bats suite is the regression guard.
4. don-petry commented on Nov 3, 2026

   

   don-petry

   on Nov 3, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Implementation Complete — PR #1463

   The implementation for issue #1462 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

   • Pull request: feat: implement issue #1462 — SonarCloud: miscellaneous findings #1463
   • Head commit: 940a48bbaef72858e20fd584acb1ff267be077be
   • Net change against main: 63 file(s), +1557/-1557 lines
   • Run: https://github.com/combsmith/.github/actions/runs/41729930269

   Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.
5. don-petry

   added a commit that references this issue on Nov 6, 2026

   feat: implement issue #1462 — SonarCloud: miscellaneous findings

   0d4fe73