Guard scanner: assertLinterIsContainerised accepts a || host-linter fallback #117

Closed
opened 2026-09-03 23:55:18 +02:00 by clawbot · 1 comment
Collaborator

Split out of issue #115part 2 of 3. #115 was scoped too large to finish in one sitting and died three times to infrastructure kills before producing anything. Do only the work below. The here-document blindness in shellCode is issue #116 and is out of scope here — do not touch shellCode or heredocTerminator.

Ordering note: #116 also edits cmd/vaultik/lintdocker_test.go. If #116 has already merged to next, rebase on it before starting. If it has not, stay strictly inside assertLinterIsContainerised and its new helper so the two changes do not collide.

The defect

assertLinterIsContainerised in cmd/vaultik/lintdocker_test.go (on next, d257f8f, around line 265) accepts any line where the substring docker occurs anywhere before the linter. So a one-line native fallback passes. Inserted into the real script/lint's main():

command -v docker >/dev/null 2>&1 || { golangci-lint run --config .golangci.yml ./...; return; }

make test stays green. That is precisely the escape hatch an earlier review mutated with, in its most natural spelling: a docker-availability check falling back to the host linter. The commit message and PR body both claim the property is established structurally; it is not.

Implementation requirements

  1. In assertLinterIsContainerised, split the joined line on ;, &&, || and |, and require the command containing the linter to begin with docker (after stripping any leading { or ().
  2. script/lint-fix must still pass on its merits, with no exemption added. Its continuation-joined docker run … golangci-lint run … contains none of those operators, so it is a single segment beginning with docker.
  3. Extract the predicate as a pure function so it gets its own table test, covering at minimum the || fallback spelling above, the script/lint-fix shape, and a plain host call.

Do not re-litigate the containerised gate itself; it is verified and out of scope.

Definition of done

  • The command -v docker >/dev/null 2>&1 || { …; return; } mutation inserted into the real script/lint, shown failing make test with a message naming the offending script and line, then reverted. Output recorded verbatim in a comment on the PR.
  • script/lint-fix still passes the tightened assertion, demonstrated, with no exemption added for it.
  • The existing 17 scripts still scan clean (no false positives introduced).
  • make check green, evidence on the PR. script/cibuild is not required — this touches test code only.
  • Branch off next. PR based on next, not main.
  • Commit title ends with a bare (closes #N) naming this issue's number — a bare #N, never a markdown link, or Gitea will not auto-close it.
Split out of [issue #115](https://git.eeqj.de/sneak/vaultik/issues/115) — **part 2 of 3**. #115 was scoped too large to finish in one sitting and died three times to infrastructure kills before producing anything. Do **only** the work below. The here-document blindness in `shellCode` is [issue #116](https://git.eeqj.de/sneak/vaultik/issues/116) and is **out of scope here** — do not touch `shellCode` or `heredocTerminator`. **Ordering note:** #116 also edits `cmd/vaultik/lintdocker_test.go`. If #116 has already merged to `next`, rebase on it before starting. If it has not, stay strictly inside `assertLinterIsContainerised` and its new helper so the two changes do not collide. ## The defect `assertLinterIsContainerised` in `cmd/vaultik/lintdocker_test.go` (on `next`, `d257f8f`, around line 265) accepts **any** line where the substring `docker` occurs anywhere before the linter. So a one-line native fallback passes. Inserted into the real `script/lint`'s `main()`: ```sh command -v docker >/dev/null 2>&1 || { golangci-lint run --config .golangci.yml ./...; return; } ``` `make test` stays green. That is precisely the escape hatch an earlier review mutated with, in its most natural spelling: a docker-availability check falling back to the host linter. The commit message and PR body both claim the property is established structurally; it is not. ## Implementation requirements 1. In `assertLinterIsContainerised`, **split the joined line on `;`, `&&`, `||` and `|`**, and require the command **containing the linter** to *begin* with `docker` (after stripping any leading `{` or `(`). 2. `script/lint-fix` must still pass **on its merits, with no exemption added**. Its continuation-joined `docker run … golangci-lint run …` contains none of those operators, so it is a single segment beginning with `docker`. 3. Extract the predicate as a **pure function** so it gets its own table test, covering at minimum the `||` fallback spelling above, the `script/lint-fix` shape, and a plain host call. Do **not** re-litigate the containerised gate itself; it is verified and out of scope. ## Definition of done - The `command -v docker >/dev/null 2>&1 || { …; return; }` mutation inserted into the **real** `script/lint`, shown **failing** `make test` with a message naming the offending script and line, then reverted. Output recorded **verbatim** in a comment on the PR. - `script/lint-fix` still passes the tightened assertion, demonstrated, with no exemption added for it. - The existing 17 scripts still scan clean (no false positives introduced). - `make check` green, evidence on the PR. `script/cibuild` is **not** required — this touches test code only. - Branch off `next`. PR based on `next`, **not** `main`. - Commit title ends with a bare ` (closes #N)` naming **this** issue's number — a bare `#N`, never a markdown link, or Gitea will not auto-close it.
clawbot added this to the 1.0.0 milestone 2026-09-03 23:55:18 +02:00
clawbot self-assigned this 2026-09-03 23:55:18 +02:00
Author
Collaborator

Closed at sneak's instruction, 2026-09-05: this was opened by an agent running on another machine outside the managed fleet, under superseded rules. Reopen if the content is wanted.

Model: fable-5-1

Closed at sneak's instruction, 2026-09-05: this was opened by an agent running on another machine outside the managed fleet, under superseded rules. Reopen if the content is wanted. Model: fable-5-1
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/vaultik#117