forked from heavy-duty/rig
26ff38390b
CI's shellcheck step set `globstar` and globbed `bin/* **/*.sh`. Globs do not match dot-prefixed names without `dotglob`, so `**/` never descended into `.github/` and two tracked scripts were linted by nothing: `.github/scripts/labels-reconcile.sh` and `.github/scripts/release-lib.sh`. release-lib.sh is the one that matters: it holds `changelog_section`, which release.yml sources to build the published release body and which test/release.sh's `changelog_armed` guard calls to decide whether main is armed. The script that decides both what ships and whether the changelog is safe was the script CI never read. Measured rather than assumed: `dotglob` adds exactly those two files to rig's line and nothing else, and `**` descending into `.git/` matches no `.sh` on a checkout. Both files already pass `shellcheck -x`, so this closes a hole in the net rather than fixing a defect behind it. Paired with a class check — `comm` against `git ls-files '*.sh'` — that fails the step naming any tracked script outside the globbed set, so the gap cannot reopen quietly. It also covers an escape `dotglob` does not: `globstar` declines to traverse symlinked directories. Refs #70 |
||
|---|---|---|
| .. | ||
| scripts | ||
| workflows | ||
| labeler.yml | ||