Skip to content

fix(shell): use [[ ]] conditionals in check-lock-sync.sh (SonarCloud bracket rule) - #87

Merged
hyperpolymath merged 1 commit into
mainfrom
sonarqube/bulk-sort
Oct 15, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
sonarqube/bulk-sort

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Converts 3 single-bracket conditional tests in scripts/check-lock-sync.sh to [[ ]] per the SonarCloud bulk-sort of assigned findings.

Verification: bash -n clean; shellcheck -S warning before/after delta is zero new findings; standalone run result identical to HEAD (exit status unchanged).

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe vibe@mistral.ai

Converted 3 single-bracket
conditional tests in scripts/check-lock-sync.sh to [[ ]]. Verified:
bash -n clean; shellcheck -S warning delta zero new findings; standalone
run result unchanged vs HEAD.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
@coderabbitai

coderabbitai Bot commented Oct 15, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 94f95200-ab41-4f80-a3c4-9799c8c165f2
📥 Commits

Reviewing files that changed from the base of the PR and between a840b56 and bf492be.

📒 Files selected for processing: 1
  • scripts/check-lock-sync.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

⏰ Context from checks skipped due to timeout: 37
  • GitHub Check: governance / Debt ratchet
  • GitHub Check: governance / Guix packaging policy (Nix retired)
  • GitHub Check: governance / Licence consistency
  • GitHub Check: governance / Trusted-base reduction policy
  • GitHub Check: governance / Workflow security linter
  • GitHub Check: governance / Security policy checks
  • GitHub Check: governance / Well-Known (RFC 9116 + RSR)
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: governance / Allowlist Preflight
  • GitHub Check: governance / Check Workflow Staleness
  • GitHub Check: governance / Language / package anti-pattern policy
  • GitHub Check: governance / Exemption ratchet
  • GitHub Check: governance / Live Actions policy (credentialed advisory)
  • GitHub Check: scan / shell-secrets
  • GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
  • GitHub Check: scan / gitleaks
  • GitHub Check: Validate DEED manifests
  • GitHub Check: check
  • GitHub Check: OCaml compiler + example matrix
  • GitHub Check: docs
  • GitHub Check: Groove manifest check
  • GitHub Check: Empty-linter (invisible characters)
  • GitHub Check: Validate eclexiaiser manifest
  • GitHub Check: Agda proofs + trusted-base budget
  • GitHub Check: Validate K9 contracts
  • GitHub Check: check
  • GitHub Check: estate-rules
  • GitHub Check: actions.lock is in sync with the workflow YAML
  • GitHub Check: Idris2 ABI proof suite
  • GitHub Check: antipattern-check
  • GitHub Check: Hypatia neurosymbolic scan
  • GitHub Check: panic-attack assail
  • GitHub Check: lint
  • GitHub Check: Runtime Policy
  • GitHub Check: openssf-compliance
  • GitHub Check: analyze (actions, none)
  • GitHub Check: semgrep-cloud-platform/scan
🧰 Additional context used
📚 Code guidelines: 1
.github/copilot-instructions.md — auto-discovered
📓 Path-based instructions: 1
Source excerpt: Annotate and document all files.

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

  • scripts/check-lock-sync.sh
🔇 Additional comments: 1
scripts/check-lock-sync.sh: 1

63-63: LGTM!

Also applies to: 69-69, 76-76

📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated the internal validation script’s condition checks. The checks performed and the circumstances in which they report failure remain unchanged, so this update does not alter the validation results or affect user-facing behaviour.

Three checks in check-lock-sync.sh now use Bash [[ ... ]] tests. Their existing failure conditions and error behaviour remain unchanged.

Changes: Lock sync checks

Layer / File(s) Summary
Update conditional syntax
scripts/check-lock-sync.sh
The awk capability, lockfile existence, and empty-workflow checks now use [[ ... ]] tests. Their failure conditions and error behaviour remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Refactor

Merge Risk: ⚪ Minimal · up to bf492

The lock-sync checks retain their existing behavior, and the repository workflow runs the script under Bash. No actionable merge-blocking risk remains.

Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Description check Warning The description explains the change and reports verification results, but it does not follow the repository template. It omits the required Summary, Changes, RSR Quality Checklist, Testing, and Screen… Update the pull request description to use the repository template. Add the required sections, list the key changes, mark applicable RSR Quality Checklist items, and place the reported verification steps under Testing. State whether Screens…
Passed Passed checks: 4 passed
Check name Status Explanation
Title check Passed The title clearly and concisely describes the main change: replacing single-bracket tests with Bash [[ ]] conditionals in check-lock-sync.sh to address the SonarCloud rule.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description explains the change and reports verification results, but it does not follow the repository template. It omits the required Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections, including the checklist confirmations.

Resolution

Update the pull request description to use the repository template. Add the required sections, list the key changes, mark applicable RSR Quality Checklist items, and place the reported verification steps under Testing. State whether Screenshots are not applicable if no screenshots or terminal output are provided.

  • Fix all pre-merge checks with AI
✨ Finishing Touches
🛠️ Fix failing CI checks
  • Commit to this branch
  • Create a new PR
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

Copy link
Copy Markdown

@coderabbitai

coderabbitai Bot commented Oct 15, 2026 •

Copy link
Copy Markdown
Contributor

@hyperpolymath
hyperpolymath merged commit dd9198f into main Oct 15, 2026
46 of 48 checks passed
@hyperpolymath
hyperpolymath deleted the sonarqube/bulk-sort branch October 15, 2026 23:18
@coderabbitai

coderabbitai Bot commented Oct 15, 2026 •

Copy link
Copy Markdown
Contributor

⚠️ Agent ran but produced no code changes.

The CI failures may require manual intervention.

View agent analysis
I made no changes. None of these failures come from this PR, and the ones that could be fixed for real would need edits to `.github/workflows/`, which I'm not allowed to make.

**The PR changes nothing.** HEAD (`bf492be`) and `origin/main` (`dd9198f`, the squash-merged #87) share no history, but `git diff origin/main HEAD` is empty, so their file trees are identical. The `[[ ]]` conversions in `scripts/check-lock-sync.sh` (lines 63, 69, 76) are already on `main`. Every failing check therefore fails the same way on `main`.

What each failure actually is:

- **Workflow security linter (checks 1–2):** The parser found a workflow with every job commented out, and three reusable-workflow call jobs that declare `timeout-minutes`, which GitHub rejects. Both are fixed in `.github/workflows/*.yml`.
- **Code quality + docs (checks 5–6):** The `editorconfig-checker` action with `version: latest` can't find the `ec-linux-amd64*` binary in the latest upstream release. This is an upstream release/action problem; the fix is to pin a version in the workflow.
- **Security policy, Well-Known, Language policy (checks 3–4, 7–11):** These run from the shared standards checkout against existing repo content. The excerpts are cut off before the actual errors, and nothing in this PR touches what they check.
- **OpenSSF `.machine_readable/STATE.a2ml` (check 16):** The file exists, but at `.machine_readable/descriptiles/STATE.a2ml`. `openssf-compliance.yml` still checks the old path, so the fix is to update that path in the workflow. I didn't add a duplicate file at the root path because it would go against the descriptiles layout.
- **OpenSSF checks 12–15 (SECURITY, LICENSE, CONTRIBUTING, README):** These look like truncated logs of steps that may have passed. `SECURITY.md` (and `SECURITY.adoc`), `LICENSE`, `CONTRIBUTING.md` and `README.adoc` all exist, and the excerpts show no error.

To get these green, someone with permission to edit workflows needs to:
1. Fix the commented-out workflow and remove `timeout-minutes` from the reusable-call jobs.
2. Pin the `editorconfig-checker` version.
3. Point `openssf-compliance.yml` at `.machine_readable/descriptiles/STATE.a2ml`.

These belong in a separate change on `main`, not in this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant