@biffo/cli 0.307.0 → 0.308.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/_skeletons/plugin-template/.github/workflows/ci.yml +15 -45
- package/_skeletons/plugin-template/scripts/guard-self-test-wiring.sh +134 -0
- package/_skeletons/sibling-template/.github/workflows/ci.yml +18 -50
- package/_skeletons/sibling-template/scripts/guard-self-test-wiring.sh +134 -0
- package/package.json +1 -1
|
@@ -140,51 +140,21 @@ jobs:
|
|
|
140
140
|
run: sh scripts/core-version-preflight.test.sh
|
|
141
141
|
- name: Guard self-test wiring — this repo's own scripts/*.test.sh
|
|
142
142
|
if: ${{ !cancelled() }}
|
|
143
|
-
# Level-3 self-audit
|
|
144
|
-
#
|
|
145
|
-
#
|
|
146
|
-
#
|
|
147
|
-
#
|
|
148
|
-
#
|
|
149
|
-
#
|
|
150
|
-
#
|
|
151
|
-
#
|
|
152
|
-
#
|
|
153
|
-
#
|
|
154
|
-
#
|
|
155
|
-
#
|
|
156
|
-
#
|
|
157
|
-
|
|
158
|
-
# named residual on #1710.
|
|
159
|
-
run: |
|
|
160
|
-
set -eu
|
|
161
|
-
guards=$(find scripts -maxdepth 1 -type f -name '*.test.sh' | sort)
|
|
162
|
-
if [ -z "$guards" ]; then
|
|
163
|
-
echo "FAIL: found 0 scripts/*.test.sh — an empty discovery is not a vacuous pass." >&2
|
|
164
|
-
exit 1
|
|
165
|
-
fi
|
|
166
|
-
missing=0
|
|
167
|
-
for g in $guards; do
|
|
168
|
-
name=$(basename "$g")
|
|
169
|
-
found=0
|
|
170
|
-
for wf in .github/workflows/*.yml .github/workflows/*.yaml; do
|
|
171
|
-
[ -f "$wf" ] || continue
|
|
172
|
-
if grep -v '^[[:space:]]*#' "$wf" | grep -q "$name"; then
|
|
173
|
-
found=1
|
|
174
|
-
fi
|
|
175
|
-
done
|
|
176
|
-
if [ "$found" -eq 1 ]; then
|
|
177
|
-
echo "OK: $name has a caller in .github/workflows/"
|
|
178
|
-
else
|
|
179
|
-
echo "MISSING CALLER: $name has no run: line anywhere in .github/workflows/" >&2
|
|
180
|
-
missing=1
|
|
181
|
-
fi
|
|
182
|
-
done
|
|
183
|
-
if [ "$missing" -ne 0 ]; then
|
|
184
|
-
echo "FAIL: at least one scripts/*.test.sh guard has zero callers." >&2
|
|
185
|
-
exit 1
|
|
186
|
-
fi
|
|
187
|
-
echo "PASS: every scripts/*.test.sh guard in this repo has a caller."
|
|
143
|
+
# Was a Level-3 self-audit reimplementing scripts/guard-self-test-
|
|
144
|
+
# wiring.sh's own logic inline (biffo-template#1710), because that
|
|
145
|
+
# script was never distributed to this skeleton and so had nothing
|
|
146
|
+
# to call here. biffo-template#1909 added it to shared-files.json's
|
|
147
|
+
# `files` list (it takes GUARD_DIR="scripts" and
|
|
148
|
+
# WORKFLOW_DIR=".github/workflows" relative to CWD, so a
|
|
149
|
+
# byte-identical copy is correct here exactly as it is at the
|
|
150
|
+
# template root) and a real copy now lives at scripts/guard-self-
|
|
151
|
+
# test-wiring.sh in this skeleton too — so this step calls THAT
|
|
152
|
+
# script instead of carrying a second copy of its logic that could
|
|
153
|
+
# drift from the original the way _extract_detail did
|
|
154
|
+
# (biffo-template#1107/#1108). A plugin generated from this
|
|
155
|
+
# skeleton fails closed from birth if a future *.test.sh guard is
|
|
156
|
+
# added here with no run: line anywhere.
|
|
157
|
+
run: sh scripts/guard-self-test-wiring.sh
|
|
188
158
|
- uses: codecov/codecov-action@v5
|
|
189
159
|
if: always()
|
|
190
160
|
with:
|
|
@@ -0,0 +1,134 @@
|
|
|
1
|
+
#!/usr/bin/env sh
|
|
2
|
+
#
|
|
3
|
+
# Does every scripts/*.test.sh guard actually get executed by this repo's
|
|
4
|
+
# own CI, rather than sitting in the tree looking like coverage?
|
|
5
|
+
#
|
|
6
|
+
# ## Why this exists (#1705)
|
|
7
|
+
#
|
|
8
|
+
# #1413/#1629/#1582 each wired ONE previously-uncalled scripts/*.test.sh
|
|
9
|
+
# guard into ci.yml or release-guards.yml by hand, and each time the fix was
|
|
10
|
+
# "add a `run:` line for this one file". That closes the instance found and
|
|
11
|
+
# leaves the class open: the next guard someone adds sits unwired exactly
|
|
12
|
+
# the same way, silently, until someone happens to notice. A guard with no
|
|
13
|
+
# caller is a fail-open — it contributes nothing to CI and looks exactly
|
|
14
|
+
# like coverage from the workflow file alone.
|
|
15
|
+
#
|
|
16
|
+
# This is the derived version: it globs scripts/*.test.sh itself, so the
|
|
17
|
+
# denominator is never a hand-maintained list that can drift from the
|
|
18
|
+
# filesystem, and it fails closed rather than reporting a partial count as
|
|
19
|
+
# success.
|
|
20
|
+
#
|
|
21
|
+
# ## Two ways a guard counts as "covered", and why both are needed
|
|
22
|
+
#
|
|
23
|
+
# 1. Already referenced by name in a real (non-comment) line somewhere in
|
|
24
|
+
# .github/workflows/*.yml — e.g. `run: sh scripts/verify-deployed.test.sh`,
|
|
25
|
+
# or a name appearing inside a multi-line `run: |` block such as the
|
|
26
|
+
# docker-wrapped `interpreter-audit.test.sh` self-test in
|
|
27
|
+
# release-guards.yml. That wrapping exists for a real reason (#1652: the
|
|
28
|
+
# self-test compares bash's output against a GENUINE dash, and some
|
|
29
|
+
# self-hosted instance runners have no dash package at all, no busybox,
|
|
30
|
+
# nothing to install it from) — re-running that guard a second time here,
|
|
31
|
+
# directly with plain `sh` on whatever runner this job happens to land
|
|
32
|
+
# on, would reproduce exactly the false-positive #1652 fixed, this time
|
|
33
|
+
# via THIS script. So a guard with a real caller elsewhere is left alone:
|
|
34
|
+
# this script only confirms the reference exists, it does not re-run it.
|
|
35
|
+
# 2. Not referenced anywhere — this script runs it directly, right here,
|
|
36
|
+
# with `sh` (the same interpreter every *.test.sh guard's own shebang
|
|
37
|
+
# declares and is invoked with elsewhere in this repo). This is what
|
|
38
|
+
# closes the class: a new guard added tomorrow with no `run:` line
|
|
39
|
+
# anywhere is executed automatically instead of silently doing nothing,
|
|
40
|
+
# and if it fails, THIS step goes red with its name and exit code.
|
|
41
|
+
#
|
|
42
|
+
# Text-presence in a non-comment line is not proof of execution (a `run:`
|
|
43
|
+
# line inside a permanently-disabled `if: false` step would still count) —
|
|
44
|
+
# that residual gap is accepted rather than solved here; it requires a step
|
|
45
|
+
# already wired well enough that #1413's own history has not produced one.
|
|
46
|
+
#
|
|
47
|
+
# ## Fail-closed requirements
|
|
48
|
+
#
|
|
49
|
+
# - Zero files matched by the glob is a FAILURE, not an empty pass — that is
|
|
50
|
+
# the exact shape of the defect this exists to catch (a discovery step
|
|
51
|
+
# that silently discovers nothing).
|
|
52
|
+
# - A guard file that is unreadable or not executable is a FAILURE.
|
|
53
|
+
# - A directly-run guard that exits non-zero is a FAILURE, reported by name.
|
|
54
|
+
# - The denominator (found / already-wired / run-here) is always printed,
|
|
55
|
+
# pass or fail, so a green run can never be read as having skipped
|
|
56
|
+
# verifying anything.
|
|
57
|
+
|
|
58
|
+
set -eu
|
|
59
|
+
|
|
60
|
+
GUARD_DIR="scripts"
|
|
61
|
+
WORKFLOW_DIR=".github/workflows"
|
|
62
|
+
|
|
63
|
+
guards=$(find "$GUARD_DIR" -maxdepth 1 -type f -name '*.test.sh' | sort)
|
|
64
|
+
|
|
65
|
+
guard_count=0
|
|
66
|
+
if [ -n "$guards" ]; then
|
|
67
|
+
guard_count=$(printf '%s\n' "$guards" | wc -l | tr -d ' ')
|
|
68
|
+
fi
|
|
69
|
+
|
|
70
|
+
if [ "$guard_count" -eq 0 ]; then
|
|
71
|
+
echo "FAIL: found 0 files matching ${GUARD_DIR}/*.test.sh — the glob matched nothing, so nothing could be verified. This is the exact defect #1705 exists to catch: treat an empty discovery as a failure, never as a vacuous pass." >&2
|
|
72
|
+
exit 1
|
|
73
|
+
fi
|
|
74
|
+
|
|
75
|
+
wired_tmp=$(mktemp)
|
|
76
|
+
trap 'rm -f "$wired_tmp"' EXIT
|
|
77
|
+
|
|
78
|
+
for wf in "$WORKFLOW_DIR"/*.yml "$WORKFLOW_DIR"/*.yaml; do
|
|
79
|
+
[ -f "$wf" ] || continue
|
|
80
|
+
# Strip comment-only lines (first non-blank character is '#') before
|
|
81
|
+
# searching, so a comment merely MENTIONING a guard's filename (there are
|
|
82
|
+
# several in this repo, documenting exactly this history) is never
|
|
83
|
+
# mistaken for a caller.
|
|
84
|
+
grep -v '^[[:space:]]*#' "$wf" | grep -o "${GUARD_DIR}/[A-Za-z0-9_-]*\.test\.sh" || true
|
|
85
|
+
done >>"$wired_tmp"
|
|
86
|
+
|
|
87
|
+
sort -u "$wired_tmp" -o "$wired_tmp"
|
|
88
|
+
|
|
89
|
+
already_wired=0
|
|
90
|
+
run_here=0
|
|
91
|
+
failed=""
|
|
92
|
+
|
|
93
|
+
for g in $guards; do
|
|
94
|
+
name=$(basename "$g")
|
|
95
|
+
|
|
96
|
+
if [ ! -r "$g" ]; then
|
|
97
|
+
echo "FAIL: $g exists but is not readable." >&2
|
|
98
|
+
exit 1
|
|
99
|
+
fi
|
|
100
|
+
if [ ! -x "$g" ]; then
|
|
101
|
+
echo "FAIL: $g exists but is not executable (chmod +x it)." >&2
|
|
102
|
+
exit 1
|
|
103
|
+
fi
|
|
104
|
+
|
|
105
|
+
if grep -qx "${GUARD_DIR}/${name}" "$wired_tmp"; then
|
|
106
|
+
already_wired=$((already_wired + 1))
|
|
107
|
+
continue
|
|
108
|
+
fi
|
|
109
|
+
|
|
110
|
+
echo "-- ${name} has no caller anywhere in ${WORKFLOW_DIR} — running it directly here --"
|
|
111
|
+
if sh "$g"; then
|
|
112
|
+
run_here=$((run_here + 1))
|
|
113
|
+
else
|
|
114
|
+
rc=$?
|
|
115
|
+
failed="${failed} - ${g} (exit ${rc})
|
|
116
|
+
"
|
|
117
|
+
fi
|
|
118
|
+
done
|
|
119
|
+
|
|
120
|
+
echo
|
|
121
|
+
echo "Guard wiring audit: found ${guard_count} ${GUARD_DIR}/*.test.sh file(s) — ${already_wired} already wired into ${WORKFLOW_DIR}, ${run_here} discovered here with no other caller and run directly, $(printf '%s' "$failed" | grep -c '.' || true) failed."
|
|
122
|
+
|
|
123
|
+
if [ -n "$failed" ]; then
|
|
124
|
+
printf 'FAIL: the following newly-discovered guard(s) failed when run:\n%s' "$failed" >&2
|
|
125
|
+
exit 1
|
|
126
|
+
fi
|
|
127
|
+
|
|
128
|
+
total_accounted=$((already_wired + run_here))
|
|
129
|
+
if [ "$total_accounted" -ne "$guard_count" ]; then
|
|
130
|
+
echo "FAIL: accounted for ${total_accounted} of ${guard_count} guard(s) — the count does not add up, which means this script has a bug rather than a clean pass." >&2
|
|
131
|
+
exit 1
|
|
132
|
+
fi
|
|
133
|
+
|
|
134
|
+
exit 0
|
|
@@ -310,56 +310,24 @@ jobs:
|
|
|
310
310
|
- name: Guard self-test wiring — this repo's own scripts/*.test.sh
|
|
311
311
|
if: ${{ !cancelled() }}
|
|
312
312
|
working-directory: .
|
|
313
|
-
# Level-3 self-audit
|
|
314
|
-
#
|
|
315
|
-
#
|
|
316
|
-
#
|
|
317
|
-
#
|
|
318
|
-
#
|
|
319
|
-
#
|
|
320
|
-
#
|
|
321
|
-
#
|
|
322
|
-
#
|
|
323
|
-
#
|
|
324
|
-
#
|
|
325
|
-
#
|
|
326
|
-
#
|
|
327
|
-
#
|
|
328
|
-
#
|
|
329
|
-
#
|
|
330
|
-
|
|
331
|
-
# before it is ever scaffolded out — that remains
|
|
332
|
-
# scripts/guard-self-test-wiring.sh's gap, tracked as the named
|
|
333
|
-
# residual on #1710.
|
|
334
|
-
run: |
|
|
335
|
-
set -eu
|
|
336
|
-
guards=$(find scripts -maxdepth 1 -type f -name '*.test.sh' | sort)
|
|
337
|
-
if [ -z "$guards" ]; then
|
|
338
|
-
echo "FAIL: found 0 scripts/*.test.sh — an empty discovery is not a vacuous pass." >&2
|
|
339
|
-
exit 1
|
|
340
|
-
fi
|
|
341
|
-
missing=0
|
|
342
|
-
for g in $guards; do
|
|
343
|
-
name=$(basename "$g")
|
|
344
|
-
found=0
|
|
345
|
-
for wf in .github/workflows/*.yml .github/workflows/*.yaml; do
|
|
346
|
-
[ -f "$wf" ] || continue
|
|
347
|
-
if grep -v '^[[:space:]]*#' "$wf" | grep -q "$name"; then
|
|
348
|
-
found=1
|
|
349
|
-
fi
|
|
350
|
-
done
|
|
351
|
-
if [ "$found" -eq 1 ]; then
|
|
352
|
-
echo "OK: $name has a caller in .github/workflows/"
|
|
353
|
-
else
|
|
354
|
-
echo "MISSING CALLER: $name has no run: line anywhere in .github/workflows/" >&2
|
|
355
|
-
missing=1
|
|
356
|
-
fi
|
|
357
|
-
done
|
|
358
|
-
if [ "$missing" -ne 0 ]; then
|
|
359
|
-
echo "FAIL: at least one scripts/*.test.sh guard has zero callers." >&2
|
|
360
|
-
exit 1
|
|
361
|
-
fi
|
|
362
|
-
echo "PASS: every scripts/*.test.sh guard in this repo has a caller."
|
|
313
|
+
# Was a Level-3 self-audit reimplementing scripts/guard-self-test-
|
|
314
|
+
# wiring.sh's own logic inline (biffo-template#1710), because that
|
|
315
|
+
# script was never distributed to this skeleton and so had nothing
|
|
316
|
+
# to call here. biffo-template#1909 added it to shared-files.json's
|
|
317
|
+
# `files` list (it takes GUARD_DIR="scripts" and
|
|
318
|
+
# WORKFLOW_DIR=".github/workflows" relative to CWD, so a
|
|
319
|
+
# byte-identical copy is correct here exactly as it is at the
|
|
320
|
+
# template root) and a real copy now lives at scripts/guard-self-
|
|
321
|
+
# test-wiring.sh in this skeleton too — so this step calls THAT
|
|
322
|
+
# script instead of carrying a second copy of its logic that could
|
|
323
|
+
# drift from the original the way _extract_detail did
|
|
324
|
+
# (biffo-template#1107/#1108). Explicit `working-directory: .`
|
|
325
|
+
# overrides this job's `defaults.run.working-directory:
|
|
326
|
+
# services/api`, because the scripts and workflows being audited
|
|
327
|
+
# live at the repo root, not under services/api. A sibling
|
|
328
|
+
# generated from this skeleton fails closed from birth if a future
|
|
329
|
+
# *.test.sh guard is added with no run: line anywhere.
|
|
330
|
+
run: sh scripts/guard-self-test-wiring.sh
|
|
363
331
|
|
|
364
332
|
# Split out of the `python` job deliberately (biffo-template#1882, mirroring
|
|
365
333
|
# #1880/#1881's identical JS-side fix): `pip-audit`'s advisory lookups are
|
|
@@ -0,0 +1,134 @@
|
|
|
1
|
+
#!/usr/bin/env sh
|
|
2
|
+
#
|
|
3
|
+
# Does every scripts/*.test.sh guard actually get executed by this repo's
|
|
4
|
+
# own CI, rather than sitting in the tree looking like coverage?
|
|
5
|
+
#
|
|
6
|
+
# ## Why this exists (#1705)
|
|
7
|
+
#
|
|
8
|
+
# #1413/#1629/#1582 each wired ONE previously-uncalled scripts/*.test.sh
|
|
9
|
+
# guard into ci.yml or release-guards.yml by hand, and each time the fix was
|
|
10
|
+
# "add a `run:` line for this one file". That closes the instance found and
|
|
11
|
+
# leaves the class open: the next guard someone adds sits unwired exactly
|
|
12
|
+
# the same way, silently, until someone happens to notice. A guard with no
|
|
13
|
+
# caller is a fail-open — it contributes nothing to CI and looks exactly
|
|
14
|
+
# like coverage from the workflow file alone.
|
|
15
|
+
#
|
|
16
|
+
# This is the derived version: it globs scripts/*.test.sh itself, so the
|
|
17
|
+
# denominator is never a hand-maintained list that can drift from the
|
|
18
|
+
# filesystem, and it fails closed rather than reporting a partial count as
|
|
19
|
+
# success.
|
|
20
|
+
#
|
|
21
|
+
# ## Two ways a guard counts as "covered", and why both are needed
|
|
22
|
+
#
|
|
23
|
+
# 1. Already referenced by name in a real (non-comment) line somewhere in
|
|
24
|
+
# .github/workflows/*.yml — e.g. `run: sh scripts/verify-deployed.test.sh`,
|
|
25
|
+
# or a name appearing inside a multi-line `run: |` block such as the
|
|
26
|
+
# docker-wrapped `interpreter-audit.test.sh` self-test in
|
|
27
|
+
# release-guards.yml. That wrapping exists for a real reason (#1652: the
|
|
28
|
+
# self-test compares bash's output against a GENUINE dash, and some
|
|
29
|
+
# self-hosted instance runners have no dash package at all, no busybox,
|
|
30
|
+
# nothing to install it from) — re-running that guard a second time here,
|
|
31
|
+
# directly with plain `sh` on whatever runner this job happens to land
|
|
32
|
+
# on, would reproduce exactly the false-positive #1652 fixed, this time
|
|
33
|
+
# via THIS script. So a guard with a real caller elsewhere is left alone:
|
|
34
|
+
# this script only confirms the reference exists, it does not re-run it.
|
|
35
|
+
# 2. Not referenced anywhere — this script runs it directly, right here,
|
|
36
|
+
# with `sh` (the same interpreter every *.test.sh guard's own shebang
|
|
37
|
+
# declares and is invoked with elsewhere in this repo). This is what
|
|
38
|
+
# closes the class: a new guard added tomorrow with no `run:` line
|
|
39
|
+
# anywhere is executed automatically instead of silently doing nothing,
|
|
40
|
+
# and if it fails, THIS step goes red with its name and exit code.
|
|
41
|
+
#
|
|
42
|
+
# Text-presence in a non-comment line is not proof of execution (a `run:`
|
|
43
|
+
# line inside a permanently-disabled `if: false` step would still count) —
|
|
44
|
+
# that residual gap is accepted rather than solved here; it requires a step
|
|
45
|
+
# already wired well enough that #1413's own history has not produced one.
|
|
46
|
+
#
|
|
47
|
+
# ## Fail-closed requirements
|
|
48
|
+
#
|
|
49
|
+
# - Zero files matched by the glob is a FAILURE, not an empty pass — that is
|
|
50
|
+
# the exact shape of the defect this exists to catch (a discovery step
|
|
51
|
+
# that silently discovers nothing).
|
|
52
|
+
# - A guard file that is unreadable or not executable is a FAILURE.
|
|
53
|
+
# - A directly-run guard that exits non-zero is a FAILURE, reported by name.
|
|
54
|
+
# - The denominator (found / already-wired / run-here) is always printed,
|
|
55
|
+
# pass or fail, so a green run can never be read as having skipped
|
|
56
|
+
# verifying anything.
|
|
57
|
+
|
|
58
|
+
set -eu
|
|
59
|
+
|
|
60
|
+
GUARD_DIR="scripts"
|
|
61
|
+
WORKFLOW_DIR=".github/workflows"
|
|
62
|
+
|
|
63
|
+
guards=$(find "$GUARD_DIR" -maxdepth 1 -type f -name '*.test.sh' | sort)
|
|
64
|
+
|
|
65
|
+
guard_count=0
|
|
66
|
+
if [ -n "$guards" ]; then
|
|
67
|
+
guard_count=$(printf '%s\n' "$guards" | wc -l | tr -d ' ')
|
|
68
|
+
fi
|
|
69
|
+
|
|
70
|
+
if [ "$guard_count" -eq 0 ]; then
|
|
71
|
+
echo "FAIL: found 0 files matching ${GUARD_DIR}/*.test.sh — the glob matched nothing, so nothing could be verified. This is the exact defect #1705 exists to catch: treat an empty discovery as a failure, never as a vacuous pass." >&2
|
|
72
|
+
exit 1
|
|
73
|
+
fi
|
|
74
|
+
|
|
75
|
+
wired_tmp=$(mktemp)
|
|
76
|
+
trap 'rm -f "$wired_tmp"' EXIT
|
|
77
|
+
|
|
78
|
+
for wf in "$WORKFLOW_DIR"/*.yml "$WORKFLOW_DIR"/*.yaml; do
|
|
79
|
+
[ -f "$wf" ] || continue
|
|
80
|
+
# Strip comment-only lines (first non-blank character is '#') before
|
|
81
|
+
# searching, so a comment merely MENTIONING a guard's filename (there are
|
|
82
|
+
# several in this repo, documenting exactly this history) is never
|
|
83
|
+
# mistaken for a caller.
|
|
84
|
+
grep -v '^[[:space:]]*#' "$wf" | grep -o "${GUARD_DIR}/[A-Za-z0-9_-]*\.test\.sh" || true
|
|
85
|
+
done >>"$wired_tmp"
|
|
86
|
+
|
|
87
|
+
sort -u "$wired_tmp" -o "$wired_tmp"
|
|
88
|
+
|
|
89
|
+
already_wired=0
|
|
90
|
+
run_here=0
|
|
91
|
+
failed=""
|
|
92
|
+
|
|
93
|
+
for g in $guards; do
|
|
94
|
+
name=$(basename "$g")
|
|
95
|
+
|
|
96
|
+
if [ ! -r "$g" ]; then
|
|
97
|
+
echo "FAIL: $g exists but is not readable." >&2
|
|
98
|
+
exit 1
|
|
99
|
+
fi
|
|
100
|
+
if [ ! -x "$g" ]; then
|
|
101
|
+
echo "FAIL: $g exists but is not executable (chmod +x it)." >&2
|
|
102
|
+
exit 1
|
|
103
|
+
fi
|
|
104
|
+
|
|
105
|
+
if grep -qx "${GUARD_DIR}/${name}" "$wired_tmp"; then
|
|
106
|
+
already_wired=$((already_wired + 1))
|
|
107
|
+
continue
|
|
108
|
+
fi
|
|
109
|
+
|
|
110
|
+
echo "-- ${name} has no caller anywhere in ${WORKFLOW_DIR} — running it directly here --"
|
|
111
|
+
if sh "$g"; then
|
|
112
|
+
run_here=$((run_here + 1))
|
|
113
|
+
else
|
|
114
|
+
rc=$?
|
|
115
|
+
failed="${failed} - ${g} (exit ${rc})
|
|
116
|
+
"
|
|
117
|
+
fi
|
|
118
|
+
done
|
|
119
|
+
|
|
120
|
+
echo
|
|
121
|
+
echo "Guard wiring audit: found ${guard_count} ${GUARD_DIR}/*.test.sh file(s) — ${already_wired} already wired into ${WORKFLOW_DIR}, ${run_here} discovered here with no other caller and run directly, $(printf '%s' "$failed" | grep -c '.' || true) failed."
|
|
122
|
+
|
|
123
|
+
if [ -n "$failed" ]; then
|
|
124
|
+
printf 'FAIL: the following newly-discovered guard(s) failed when run:\n%s' "$failed" >&2
|
|
125
|
+
exit 1
|
|
126
|
+
fi
|
|
127
|
+
|
|
128
|
+
total_accounted=$((already_wired + run_here))
|
|
129
|
+
if [ "$total_accounted" -ne "$guard_count" ]; then
|
|
130
|
+
echo "FAIL: accounted for ${total_accounted} of ${guard_count} guard(s) — the count does not add up, which means this script has a bug rather than a clean pass." >&2
|
|
131
|
+
exit 1
|
|
132
|
+
fi
|
|
133
|
+
|
|
134
|
+
exit 0
|