Feature/003 review fixes#12
Merged
Merged
Conversation
added 5 commits
June 7, 2026 15:18
Review finding: the trivy install piped an UNPINNED main-branch contrib/install.sh into sh, inconsistent with every SHA-pinned action in this workflow and running in the artifact-signing job. Pin both the install.sh ref and the installed version to v0.71.0. Verified the pinned command installs 0.71.0. Author: bobinson
Review finding: the comment claimed resolve_path canonicalises /etc->/private/etc, but BSD readlink has no -f so it may not. Reword to state the /private/* forms are blacklisted explicitly (not relied upon to resolve). No behavior change. Author: bobinson
Review finding: backend/.golangci.yml excludes errcheck from *_test.go, so the hand-added _ = / _, _ = on test-server Encode/Write were redundant and made client_test.go inconsistent with the other test files. Removed all of them (incl. 3 pre-existing) so the file is uniformly unprefixed. golangci clean, go test passes. Author: bobinson
Review finding: the portable sha256sum/shasum block was copy-pasted into build-release.sh, smoke-install.sh and smoke-negative.sh. Extract scripts/lib/hash.sh with sha256_of() (adds the missing 'neither tool present' error arm), sourced by all three. TDD: test_hash_sh.sh added (RED before the helper, GREEN after) and wired into lint-installer; shellcheck now covers scripts/lib. Verified: all 4 release platforms build, SHA256SUMS matches independent sha256sum, smoke suites pass. Author: bobinson
macos-13 (Intel) was deprecated 2025-09-22 and fully retired 2025-12-08, so the darwin-amd64 build-binary leg hung forever 'waiting for a runner' (no macos-13 exists to assign). macos-15-intel is GitHub's x86_64 replacement. arm64 stays on macos-14 (still supported). Author: bobinson
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Components Affected
backend/)agents/)frontend/)cli/)docs/)