Skip to content

Commit 070ce63

Browse files
Jonathan D.A. Jewellclaude
Jonathan D.A. Jewell
and
claude
committed
fix: 7 high-severity bugs + repo path overrides for monorepo dispatch
Corrective fixes: - fix-missing-spdx.sh: preserve shebang before SPDX header insertion - fix-sast-workflow.sh: use double quotes in YAML flow sequences - fix-believe-me.sh: check preceding line before inserting PROOF_TODO - fix-sorry-lean.sh: same idempotency fix for Lean sorry - fix-unsafe-type-coercion.sh: same idempotency fix for SAFETY comments - fix-unsafe-ffi.sh: remove trap overwrite in loop - Delete fix-missing-permissions.sh (duplicate of fix-workflow-permissions.sh) Dispatch improvements: - repo-path-overrides.json: 96 monorepo subdirectory mappings - dispatch-runner.sh: resolve repos via overrides when not found at top level Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent e0f1314 commit 070ce63

9 files changed

Lines changed: 151 additions & 65 deletions

‎scripts/dispatch-runner.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,18 @@ execute_entry() {
192192
return
193193
fi
194194
repo_path="$REPOS_BASE/$repo"
195+
196+
# If repo not found, check path overrides (monorepo subdirectories)
197+
if [[ ! -d "$repo_path" ]]; then
198+
local overrides="$FLEET_SCRIPTS/repo-path-overrides.json"
199+
if [[ -f "$overrides" ]]; then
200+
local override
201+
override=$(jq -r --arg r "$repo" '.[$r] // empty' "$overrides" 2>/dev/null || true)
202+
if [[ -n "$override" && -d "$override" ]]; then
203+
repo_path="$override"
204+
fi
205+
fi
206+
fi
195207
fi
196208

197209
# Double-check path stays within REPOS_BASE

‎scripts/fix-believe-me.sh‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,12 @@ while IFS= read -r -d '' file; do
2727
echo " FOUND $rel_path — $count believe_me call(s)"
2828

2929
# Add TODO comments above believe_me calls (only on non-comment lines)
30-
# Use a unique marker so re-runs are idempotent
31-
sed -i '/^\s*--/!{/believe_me/{/PROOF_TODO/!s/\(.*believe_me\)/-- PROOF_TODO: Replace believe_me with actual proof\n\1/}}' "$file" 2>/dev/null || true
30+
# Skip if PROOF_TODO already exists on the preceding line (prevents duplicates on re-run)
31+
if grep -B1 'believe_me' "$file" 2>/dev/null | grep -q 'PROOF_TODO'; then
32+
echo " (PROOF_TODO comments already present — skipping)"
33+
else
34+
sed -i '/^\s*--/!{/believe_me/{/PROOF_TODO/!s/\(.*believe_me\)/-- PROOF_TODO: Replace believe_me with actual proof\n\1/}}' "$file" 2>/dev/null || true
35+
fi
3236

3337
((FIXED_COUNT++)) || true
3438
fi

‎scripts/fix-missing-permissions.sh‎

Lines changed: 0 additions & 46 deletions
This file was deleted.

‎scripts/fix-missing-spdx.sh‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,11 +50,16 @@ fi
5050
# Create temp file with SPDX header
5151
TEMP_FILE=$(mktemp)
5252

53-
# Write SPDX header
54-
echo "${COMMENT_PREFIX} SPDX-License-Identifier: ${DEFAULT_LICENSE}" > "$TEMP_FILE"
55-
56-
# Append original file content
57-
cat "$FULL_PATH" >> "$TEMP_FILE"
53+
# Check if line 1 is a shebang — if so, preserve it before the SPDX header
54+
FIRST_LINE=$(head -1 "$FULL_PATH")
55+
if [[ "$FIRST_LINE" == "#!"* ]]; then
56+
echo "$FIRST_LINE" > "$TEMP_FILE"
57+
echo "${COMMENT_PREFIX} SPDX-License-Identifier: ${DEFAULT_LICENSE}" >> "$TEMP_FILE"
58+
tail -n +2 "$FULL_PATH" >> "$TEMP_FILE"
59+
else
60+
echo "${COMMENT_PREFIX} SPDX-License-Identifier: ${DEFAULT_LICENSE}" > "$TEMP_FILE"
61+
cat "$FULL_PATH" >> "$TEMP_FILE"
62+
fi
5863

5964
# Replace original file
6065
mv "$TEMP_FILE" "$FULL_PATH"

‎scripts/fix-sast-workflow.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ for i in "${!LANGUAGES[@]}"; do
6464
if [[ $i -gt 0 ]]; then
6565
LANG_MATRIX+=", "
6666
fi
67-
LANG_MATRIX+="'${LANGUAGES[$i]}'"
67+
LANG_MATRIX+="\"${LANGUAGES[$i]}\""
6868
done
6969
LANG_MATRIX+="]"
7070

‎scripts/fix-sorry-lean.sh‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,12 @@ while IFS= read -r -d '' file; do
3535
echo " FOUND $rel_path — $count sorry occurrence(s)"
3636

3737
# Add PROOF_TODO comment above sorry lines (only on non-comment lines)
38-
# Idempotent: skip if PROOF_TODO already present on the line or preceding line
39-
# Uses sed to insert a comment line before any line containing sorry as a word
40-
sed -i '/^\s*--/!{/\bsorry\b/{/PROOF_TODO/!s/\(.*\bsorry\b\)/-- PROOF_TODO: Replace sorry with actual proof\n\1/}}' "$file" 2>/dev/null || true
38+
# Skip if PROOF_TODO already exists on a preceding line (prevents duplicates on re-run)
39+
if grep -B1 '\bsorry\b' "$file" 2>/dev/null | grep -q 'PROOF_TODO'; then
40+
echo " (PROOF_TODO comments already present — skipping)"
41+
else
42+
sed -i '/^\s*--/!{/\bsorry\b/{/PROOF_TODO/!s/\(.*\bsorry\b\)/-- PROOF_TODO: Replace sorry with actual proof\n\1/}}' "$file" 2>/dev/null || true
43+
fi
4144

4245
((FIXED_COUNT++)) || true
4346
SORRY_TOTAL=$((SORRY_TOTAL + count))

‎scripts/fix-unsafe-ffi.sh‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ while IFS= read -r -d '' file; do
3030

3131
# Process the file line-by-line using a temp file for output
3232
tmpfile="$(mktemp)"
33-
trap "rm -f '$tmpfile'" EXIT
3433

3534
prev_line=""
3635
line_num=0
@@ -66,7 +65,6 @@ while IFS= read -r -d '' file; do
6665
fi
6766

6867
rm -f "$tmpfile"
69-
trap - EXIT
7068

7169
done < <(find "$REPO_PATH" -type f -name "*.rs" \
7270
-not -path "*/\.git/*" \

‎scripts/fix-unsafe-type-coercion.sh‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,12 @@ while IFS= read -r -d '' file; do
3131
count=$(grep -v '^\s*--' "$file" 2>/dev/null | grep -c 'unsafeCoerce' || echo 0)
3232
echo " FOUND [Haskell] $rel_path — $count unsafeCoerce call(s)"
3333

34-
# Idempotent: only add comment if SAFETY marker not already present on that line group
35-
sed -i '/^\s*--/!{/unsafeCoerce/{/SAFETY.*unsafeCoerce/!s/\(.*unsafeCoerce\)/-- SAFETY: unsafeCoerce bypasses type checker — replace with safe cast\n\1/}}' "$file" 2>/dev/null || true
34+
# Idempotent: skip if SAFETY comment already exists on preceding line
35+
if grep -B1 'unsafeCoerce' "$file" 2>/dev/null | grep -q 'SAFETY'; then
36+
echo " (SAFETY comments already present — skipping)"
37+
else
38+
sed -i '/^\s*--/!{/unsafeCoerce/{/SAFETY.*unsafeCoerce/!s/\(.*unsafeCoerce\)/-- SAFETY: unsafeCoerce bypasses type checker — replace with safe cast\n\1/}}' "$file" 2>/dev/null || true
39+
fi
3640

3741
((FIXED_COUNT++)) || true
3842
fi
@@ -50,8 +54,12 @@ while IFS= read -r -d '' file; do
5054
count=$(grep -c 'Obj\.magic' "$file" || echo 0)
5155
echo " FOUND [OCaml] $rel_path — $count Obj.magic call(s)"
5256

53-
# Idempotent: only add comment if SAFETY marker not already present
54-
sed -i '/Obj\.magic/{/SAFETY.*Obj\.magic/!s/\(.*Obj\.magic\)/(* SAFETY: Obj.magic bypasses type checker — use proper conversion *)\n\1/}' "$file" 2>/dev/null || true
57+
# Idempotent: skip if SAFETY comment already exists on preceding line
58+
if grep -B1 'Obj\.magic' "$file" 2>/dev/null | grep -q 'SAFETY'; then
59+
echo " (SAFETY comments already present — skipping)"
60+
else
61+
sed -i '/Obj\.magic/{/SAFETY.*Obj\.magic/!s/\(.*Obj\.magic\)/(* SAFETY: Obj.magic bypasses type checker — use proper conversion *)\n\1/}' "$file" 2>/dev/null || true
62+
fi
5563

5664
((FIXED_COUNT++)) || true
5765
fi
@@ -69,8 +77,12 @@ while IFS= read -r -d '' file; do
6977
count=$(grep -c 'Admitted' "$file" || echo 0)
7078
echo " FOUND [Coq] $rel_path — $count Admitted usage(s)"
7179

72-
# Idempotent: only add comment if PROOF_TODO marker not already present
73-
sed -i '/Admitted/{/PROOF_TODO/!s/\(.*Admitted\)/(* PROOF_TODO: Replace Admitted with actual proof *)\n\1/}' "$file" 2>/dev/null || true
80+
# Idempotent: skip if PROOF_TODO comment already exists on preceding line
81+
if grep -B1 'Admitted' "$file" 2>/dev/null | grep -q 'PROOF_TODO'; then
82+
echo " (PROOF_TODO comments already present — skipping)"
83+
else
84+
sed -i '/Admitted/{/PROOF_TODO/!s/\(.*Admitted\)/(* PROOF_TODO: Replace Admitted with actual proof *)\n\1/}' "$file" 2>/dev/null || true
85+
fi
7486

7587
((FIXED_COUNT++)) || true
7688
fi

‎scripts/repo-path-overrides.json‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"absolute-zero": "/var/mnt/eclipse/repos/maa-framework/absolute-zero",
3+
"accessibilitybot": "/var/mnt/eclipse/repos/gitbot-fleet/bots/accessibilitybot",
4+
"affinescript": "/var/mnt/eclipse/repos/nextgen-languages/affinescript",
5+
"aggregate-library": "/var/mnt/eclipse/repos/developer-ecosystem/aggregate-library",
6+
"aletheia": "/var/mnt/eclipse/repos/maa-framework/aletheia",
7+
"algorithm-shield": "/var/mnt/eclipse/repos/misinformation-defence-platform/algorithm-shield",
8+
"asdf-augmenters": "/var/mnt/eclipse/repos/asdf-tool-plugins/asdf-augmenters",
9+
"avow-protocol": "/var/mnt/eclipse/repos/standards/avow-protocol",
10+
"axel-protocol": "/var/mnt/eclipse/repos/standards/axel-protocol",
11+
"Axiom.jl": "/var/mnt/eclipse/repos/developer-ecosystem/julia-ecosystem/packages/Axiom.jl",
12+
"betlang": "/var/mnt/eclipse/repos/nextgen-languages/betlang",
13+
"bitfuckit": "/var/mnt/eclipse/repos/reposystem/bitfuckit",
14+
"blue-screen-of-app": "/var/mnt/eclipse/repos/games & trivia/blue-screen-of-app",
15+
"BowtieRisk.jl": "/var/mnt/eclipse/repos/developer-ecosystem/julia-ecosystem/packages/BowtieRisk.jl",
16+
"broad-spectrum": "/var/mnt/eclipse/repos/ambientops/broad-spectrum",
17+
"cadre-router": "/var/mnt/eclipse/repos/developer-ecosystem/rescript-ecosystem/cadre-router",
18+
"candy-crash": "/var/mnt/eclipse/repos/games & trivia/candy-crash",
19+
"casket-ssg": "/var/mnt/eclipse/repos/asdf-tool-plugins/asdf-plugin-collection/plugins/casket-ssg",
20+
"cerro-torre": "/var/mnt/eclipse/repos/odds-and-sods-package-manager/services/cerro-torre",
21+
"cipherbot": "/var/mnt/eclipse/repos/gitbot-fleet/bots/cipherbot",
22+
"claim-forge": "/var/mnt/eclipse/repos/reposystem/claim-forge",
23+
"claude-integrations": "/var/mnt/eclipse/repos/patallm-gallery/claude-integrations",
24+
"coq-jr": "/var/mnt/eclipse/repos/developer-ecosystem/coq-ecosystem/coq-jr",
25+
"czech-file-knife": "/var/mnt/eclipse/repos/ambientops/czech-file-knife",
26+
"deno-ecosystem": "/var/mnt/eclipse/repos/developer-ecosystem/deno-ecosystem",
27+
"dicti0nary-attack": "/var/mnt/eclipse/repos/games & trivia/dicti0nary-attack",
28+
"did-you-actually-do-that": "/var/mnt/eclipse/repos/patallm-gallery/did-you-actually-do-that",
29+
"disinfo-nesy-detector": "/var/mnt/eclipse/repos/neural-foundations/satellites/neurosymbolic/disinfo-nesy-detector",
30+
"dnfinition": "/var/mnt/eclipse/repos/ambientops/total-update/elixir/dnfinition",
31+
"echidnabot": "/var/mnt/eclipse/repos/echidna/echidnabot",
32+
"eclexia": "/var/mnt/eclipse/repos/nextgen-languages/eclexia",
33+
"elegant-state": "/var/mnt/eclipse/repos/neural-foundations/satellites/agentic/elegant-state",
34+
"error-lang": "/var/mnt/eclipse/repos/nextgen-languages/error-lang",
35+
"esn": "/var/mnt/eclipse/repos/neural-foundations/satellites/neurosymbolic/esn",
36+
"finishingbot": "/var/mnt/eclipse/repos/gitbot-fleet/bots/finishingbot",
37+
"fogbinder": "/var/mnt/eclipse/repos/zotero-tools/fogbinder",
38+
"formdb-http": "/var/mnt/eclipse/repos/nextgen-databases/lithoglyph/formdb-http",
39+
"games": "/var/mnt/eclipse/repos/games & trivia",
40+
"glambot": "/var/mnt/eclipse/repos/gitbot-fleet/bots/glambot",
41+
"glyphbase": "/var/mnt/eclipse/repos/nextgen-databases/lithoglyph/glyphbase",
42+
"gql-dt": "/var/mnt/eclipse/repos/nextgen-databases/lithoglyph/gql-dt",
43+
"hybrid-automation-router": "/var/mnt/eclipse/repos/ambientops/hybrid-automation-router",
44+
"IDApixiTIK": "/var/mnt/eclipse/repos/idaptik",
45+
"idris2-ecosystem": "/var/mnt/eclipse/repos/developer-ecosystem/idris2-ecosystem",
46+
"immutable-linux-auditor": "/var/mnt/eclipse/repos/ambientops/immutable-linux-auditor",
47+
"indieweb2-bastion": "/var/mnt/eclipse/repos/civic-connect/indieweb2-bastion",
48+
"julia-the-viper": "/var/mnt/eclipse/repos/nextgen-languages/julia-the-viper",
49+
"k9-svc": "/var/mnt/eclipse/repos/standards/k9-svc",
50+
"kea-tools": "/var/mnt/eclipse/repos/kea/kea-tools",
51+
"kith": "/var/mnt/eclipse/repos/developer-ecosystem/well-known-ecosystem/kith",
52+
"language-bridges": "/var/mnt/eclipse/repos/nextgen-languages/language-bridges",
53+
"language-interop-compiler": "/var/mnt/eclipse/repos/nextgen-languages/language-interop-compiler",
54+
"lithoglyph": "/var/mnt/eclipse/repos/nextgen-databases/lithoglyph",
55+
"llm-tools": "/var/mnt/eclipse/repos/patallm-gallery/llm-tools",
56+
"lol": "/var/mnt/eclipse/repos/standards/lol",
57+
"lsm": "/var/mnt/eclipse/repos/neural-foundations/satellites/neurosymbolic/lsm",
58+
"mcp-repo-guardian": "/var/mnt/eclipse/repos/standards/0-ai-gatekeeper-protocol/mcp-repo-guardian",
59+
"my-lang": "/var/mnt/eclipse/repos/nextgen-languages/my-lang",
60+
"nerdsafe-restart": "/var/mnt/eclipse/repos/ambientops/nerdsafe-restart",
61+
"nick-shells": "/var/mnt/eclipse/repos/ambientops/nick-shells",
62+
"oblibeny": "/var/mnt/eclipse/repos/nextgen-languages/oblibeny",
63+
"package-publishers": "/var/mnt/eclipse/repos/developer-ecosystem/package-publishers",
64+
"_pathroot": "/var/mnt/eclipse/repos/ambientops/_pathroot",
65+
"personal-sysadmin": "/var/mnt/eclipse/repos/ambientops/personal-sysadmin",
66+
"phantom-metal-taste": "/var/mnt/eclipse/repos/games & trivia/phantom-metal-taste",
67+
"phronesis": "/var/mnt/eclipse/repos/nextgen-languages/phronesis",
68+
"poly-k8s-mcp": "/var/mnt/eclipse/repos/flatracoon/netstack/modules/poly-k8s-mcp",
69+
"poly-secret-mcp": "/var/mnt/eclipse/repos/flatracoon/netstack/modules/poly-secret-mcp",
70+
"ProvenCrypto.jl": "/var/mnt/eclipse/repos/developer-ecosystem/julia-ecosystem/packages/ProvenCrypto.jl",
71+
"qubes-sdp": "/var/mnt/eclipse/repos/aerie/qubes-sdp",
72+
"reasonably-good-token-vault": "/var/mnt/eclipse/repos/ambientops/reasonably-good-token-vault",
73+
"recon-silly-ation": "/var/mnt/eclipse/repos/developer-ecosystem/satellites/developer-ux/recon-silly-ation",
74+
"repo-batcher": "/var/mnt/eclipse/repos/reposystem/scaffoldia/repo-batcher",
75+
"repo-guardian-fs": "/var/mnt/eclipse/repos/standards/0-ai-gatekeeper-protocol/repo-guardian-fs",
76+
"rescript-ecosystem": "/var/mnt/eclipse/repos/developer-ecosystem/rescript-ecosystem",
77+
"rhodibot": "/var/mnt/eclipse/repos/gitbot-fleet/bots/rhodibot",
78+
"rhodium-standard-repositories": "/var/mnt/eclipse/repos/standards/rhodium-standard-repositories",
79+
"robot-repo-automaton": "/var/mnt/eclipse/repos/developer-ecosystem/satellites/repo-management/robot-repo-automaton",
80+
"safe-brute-force": "/var/mnt/eclipse/repos/games & trivia/safe-brute-force",
81+
"scaffoldia": "/var/mnt/eclipse/repos/reposystem/scaffoldia",
82+
"seambot": "/var/mnt/eclipse/repos/gitbot-fleet/bots/seambot",
83+
"selur": "/var/mnt/eclipse/repos/odds-and-sods-package-manager/services/selur",
84+
"SMTLib.jl": "/var/mnt/eclipse/repos/developer-ecosystem/julia-ecosystem/packages/SMTLib.jl",
85+
"sustainabot": "/var/mnt/eclipse/repos/gitbot-fleet/bots/sustainabot",
86+
"svalinn": "/var/mnt/eclipse/repos/project-wharf/infra/svalinn",
87+
"system-tools": "/var/mnt/eclipse/repos/ambientops/system-tools",
88+
"test-repo": "/var/mnt/eclipse/repos/hypatia/integration/fixtures/test-repo",
89+
"the-hotchocolabot": "/var/mnt/eclipse/repos/gitbot-fleet/bots/the-hotchocolabot",
90+
"thejeffparadox": "/var/mnt/eclipse/repos/games & trivia/thejeffparadox",
91+
"total-update": "/var/mnt/eclipse/repos/ambientops/total-update",
92+
"union-policy-parser": "/var/mnt/eclipse/repos/palimpsest-plasma/union-policy-parser",
93+
"verified-container-spec": "/var/mnt/eclipse/repos/stapeln/verified-container-spec",
94+
"verisimdb": "/var/mnt/eclipse/repos/nextgen-databases/verisimdb",
95+
"vordr": "/var/mnt/eclipse/repos/stapeln/container-stack/vordr",
96+
"well-known-ecosystem": "/var/mnt/eclipse/repos/developer-ecosystem/well-known-ecosystem",
97+
"zig-ffi": "/var/mnt/eclipse/repos/developer-ecosystem/rescript-ecosystem/packages/ffi/zig-ffi"
98+
}

0 commit comments

Comments
 (0)