Repository navigation
lint-rust-cache-guard: here-strings, not printf | grep -q — pipefail makes the membership test lie - #22
Merged
Conversation
Under `set -o pipefail` — which this script sets — `grep -q` exits at the first match and SIGPIPEs the writer, so the PIPELINE's status can be 141 even though the test matched. Both membership tests here are load-bearing: one decides whether a workflow is judged at all, the other is the ONLY exoneration from a BLOCK. Either answering the opposite of the truth, silently, is worse than not having the lint at all. Found by rmedia, which bans the shape repo-wide (falsify-pipefail-contains.sh) and whose CI failed the sibling copy of this lint on its first run. This copy was written from the same source and carries the same defect, so it is fixed here rather than left to be discovered separately. All three sites now use here-strings, and has_private_cargo_home splits its two greps so an empty match is an explicit `return 1` rather than a pipeline status. Measured after: selftest 4/4 and the scan reports its usual denominator.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the rust-cache guard landed earlier today. A correctness fix to the lint itself, found by another repo's policy.
The defect
The guard sets
set -uo pipefail, and two of its predicates were written asprintf ... | grep -q:Under
pipefail,grep -qexits at the first match and SIGPIPEs the writer, so the pipeline's status can be 141 even though the test matched. Both predicates are load-bearing: the first decides whether a workflow is judged at all, and the second is the only exoneration from a BLOCK. Either one answering the opposite of the truth — silently — is worse than not having the lint.How it was found
paiml/rmediabans the shape repo-wide withscripts/falsify-pipefail-contains.sh, and its CI failed the sibling copy of this same lint on its first run:This copy was written from the same source and carries the same defect, so it is fixed here rather than left for someone to rediscover.
Change
All three sites use here-strings.
has_private_cargo_homesplits its two greps so an empty match is an explicitreturn 1rather than a pipeline status. The header names the shape it bans and explains why — rmedia's scanner strips comments before matching, which its own case 7 pins.Measured:
--selftest4/4, the scan reports its usual denominator,bashrs lint0 errors.🤖 Generated with Claude Code