skynet/claude-foundations
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

formatters/sh: SETE-2 must scan the whole file, not line by line

Browse Source 
SETE-2 matched `sh -c "..."` with a per-line regex requiring both quotes on one
line. The shape that motivated the check spans lines:

    sh -c "
        hugo mod get ...
        hugo mod tidy
    "

so the real sync-deps bug — the one this check exists for — was never flagged.
Verified against the actual pre-fix sync-deps: now reports at line 358,
"4 commands and no 'set -e' inside".

Scans the file text with re.DOTALL and reports the line of the match start.
Falls back to counting non-blank lines when the body is newline- rather than
;-separated, which is what the multi-line form looks like.

Adds both regression cases (multi-line without set -e must flag; multi-line
with set -e must not). Verified they go red when the whole-file scan is
disabled. Neither of the two fixed real scripts is flagged.

Note for whoever extends this suite: fixtures written with a heredoc inside it
did not behave; the printf form does. Both new tests use printf.

Claude-Session: https://claude.ai/code/session_014KNyfHmHpMbdMrHZXDRkAp
This commit is contained in:
Paul O'Reilly
2026-09-23 19:49:33 +12:00
parent 18861089bf
commit dda01ebeca
2 changed files with 41 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
formatters/tests/test-sh-formatter.sh
View File

@@ -234,6 +234,29 @@ else
fail "missing-tool warning" "expected exit 0 + warning line, got exit=$rc stderr=$stderr_content"
fi
# SETE-2 must see a MULTI-LINE `sh -c "..."`. That is the shape of the real
# sync-deps bug; the original per-line regex required both quotes on one line
# and missed it entirely.
f="$TMPDIR/sete2-multiline.sh"
printf '#!/usr/bin/env bash\nset -euo pipefail\ndocker run --rm img sh -c "\n hugo mod get a b c\n hugo mod tidy\n"\n' > "$f"
out="$(bash "$FORMATTER" "$f" 2>&1)"
if printf '%s' "$out" | grep -q "SETE-2"; then
pass "SETE-2 flags a multi-line sh -c with no set -e"
else
fail "SETE-2 MISSED the multi-line sh -c form (the real sync-deps bug); got: $out"
fi
f="$TMPDIR/sete2-multiline-ok.sh"
printf '#!/usr/bin/env bash\nset -euo pipefail\ndocker run --rm img sh -c "\n set -e\n hugo mod get a b c\n hugo mod tidy\n"\n' > "$f"
out="$(bash "$FORMATTER" "$f" 2>&1)"
if printf '%s' "$out" | grep -q "SETE-2"; then
fail "SETE-2 false-positived on a multi-line sh -c that DOES set -e"
else
pass "SETE-2 quiet when the multi-line sh -c sets -e"
fi
# ===========================================================================
echo ""
echo "Results: $PASS passed, $FAIL failed"