Repository navigation
Pre-commit: fix the shellcheck and hadolint findings and run every hook in CI (closes #368) - #374
Merged
Merged
Conversation
…ok in CI (closes #368, refs #365) The Pre-commit workflow skipped shellcheck and hadolint-docker because the repository had findings for both, so neither protected anything. This fixes the findings and removes the SKIP. Shell scripts (build.sh, build-native.sh, run_examples.sh, native/scripts/build-image.sh): ls parsing becomes find or a glob loop (newest_wheel() compares mtimes with -nt), word-split argument strings become arrays (DOCKER_BUILD_ARGS, read -r -a for the example arguments and the EXAMPLES globs), the javac source list goes through find -print0 | xargs -0, expansions are quoted. run_examples.sh run against a stub interpreter gives the same calls, outputs and GitHub outputs as before. Dockerfile.build: each stage that runs pipes sets SHELL bash -o pipefail (DL4006); the jdeps, grep and paste steps keep their old tolerance with || true, as build-native.sh has it; jlink gets its --module-path through the positional parameters; the smoke test script is written with printf (bash echo does not expand \n, dash echo did; the bytes are identical); --no-install-recommends (DL3015). DL3008 (pinned apt versions) is ignored per instruction with the reason: the base images are rolling tags. .shellcheckrc follows the source lines (external-sources, SCRIPTDIR). #365 code and config items: the local hook runs with language python instead of the system python3, the pyproject.toml comment names a README section that exists, and the version examples of build.sh and build_wheel.py name 26.12.1 and 26.11.1. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
tae898
force-pushed
the
chore/368-365-hygiene
branch
from
November 12, 2026 01:52
585cf54 to
eebdcee
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #368. Refs #365 (its code and config items; the docs items are in a second pull request).
The
Pre-commitworkflow skippedshellcheckandhadolint-docker, so those two hooks protected nothing. I fixed the findings and removed theSKIPline with its comment, so every hook runs in CI.What changed:
scripts/build.sh,scripts/build-native.sh,scripts/run_examples.sh,native/scripts/build-image.sh:lsparsing becamefindor a glob loop, word-split argument strings became arrays, the source list of the Java bridge goes throughfind -print0 | xargs -0, expansions are quoted. TheSC2153onEXAMPLESinrun_examples.shis a false positive (an input of the workflows), disabled on that one line with the reason.scripts/Dockerfile.build: every stage with a pipe setsSHELL ["/bin/bash", "-o", "pipefail", "-c"](DL4006). Thejdeps,grepandpastesteps keep their old tolerance with|| true, asbuild-native.shhas it.jlinktakes--module-paththrough the positional parameters, the smoke test script is written withprintf(bashechodoes not expand\n,dashdid), andapt-getuses--no-install-recommends. DL3008 (pinnedaptversions) is ignored per instruction, with the reason next to it: the base images are rolling tags, and a pinned version disappears at the next point release..shellcheckrc: followsourcelines.no-old-package-namehook useslanguage: pythoninstead of the systempython3; thepyproject.tomlcomment names the README section that exists; the version examples inbuild.shandbuild_wheel.pyname 26.12.1 and 26.11.1.What I ran:
uvx pre-commit run --all-fileswith noSKIP, all hooks green. I ranrun_examples.shold and new against a stub interpreter in a fakeexamples/tree: the calls, outputs and GitHub outputs are identical, apart from one difference in my favour (a glob without a match no longer aborts the run). The smoke test script thatprintfwrites has the same bytes as thedashechowrote, minus one trailing newline. I also unit-tested the newfind,-ntand array constructs against the old ones.What I could not run here: the Docker build and the native image scripts. They run in the existing CI jobs (the
test-jvm.ymlbuilds and the native build), and those must be green before this merges.🤖 Generated with Claude Code