Attribute ci-scripts findings to enforced rules

Sync scripts/rules with policyengine-api. Once a CI-script rule is enforced
it has no baseline, so its findings were reported as [registry]; fall back
to the rule whose id ends in the check's name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: anth-volk

docs/generated/rules.md

@@ -1,6 +1,6 @@
 # Rules
 
-Generated by `python -m scripts.rules render` (scripts/rules v0.1.0, tool sha256 `afc55ba219f1`) from `rules/registry.toml`. Do not edit by hand.
+Generated by `python -m scripts.rules render` (scripts/rules v0.1.0, tool sha256 `86b191f2ebb3`) from `rules/registry.toml`. Do not edit by hand.
 
 Every rule that governs `policyengine-sim-api` is listed here with how it is enforced. Blocking rules fail CI. The Gaps section lists what is written down but not yet enforced or proven. To add or change a rule, see `docs/engineering/skills/rules-registry.md`.
 

scripts/rules/ci_scripts.py

@@ -25,6 +25,13 @@
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
 SEPARATOR = " :: "
+# Rule ids end with these names (``<repo>.ci.<name>``). Used to attribute a
+# finding to its rule once the rule is enforced and has no baseline left.
+RULE_NAMES = {
+    "multiline": "multiline-run-is-script",
+    "untested": "workflow-scripts-tested",
+    "shellcheck": "shell-scripts-pass-shellcheck",
+}
 
 
 @dataclass
@@ -118,10 +125,15 @@ def _baseline(root: Path, path: str) -> set[str]:
     }
 
 
-def _rule_for(registry: Registry, baseline: str) -> str | None:
+def _rule_for(registry: Registry, baseline: str, check: str) -> str | None:
     for rule in registry.rules:
         if rule.baseline is not None and rule.baseline.file == baseline:
             return rule.id
+    for rule in registry.rules:
+        if rule.enforcer.get("name") == "ci-scripts" and rule.id.endswith(
+            f".ci.{RULE_NAMES[check]}"
+        ):
+            return rule.id
     return None
 
 
@@ -130,30 +142,33 @@ def compare(registry: Registry, findings: Findings, root: Path) -> list[Violatio
     assert config is not None
     checks = (
         (
+            "multiline",
             "multi-line run: block",
             findings.multiline,
             config.multiline_baseline,
             "move the commands into a tested script under "
             f"{config.scripts_dir} and call it from a single-line run:",
         ),
         (
+            "untested",
             "untested workflow script",
             findings.untested,
             config.untested_baseline,
             "add a test that runs the script (see docs/engineering/skills/ci-workflows.md)",
         ),
         (
+            "shellcheck",
             "shellcheck finding in",
             findings.shellcheck,
             config.shellcheck_baseline,
             "fix what `shellcheck <script>` reports",
         ),
     )
     violations = []
-    for label, found, baseline_path, fix in checks:
+    for check, label, found, baseline_path, fix in checks:
         if found is None:
             continue
-        rule_id = _rule_for(registry, baseline_path)
+        rule_id = _rule_for(registry, baseline_path, check)
         baseline = _baseline(root, baseline_path)
         for entry in sorted(found - baseline):
             violations.append(Violation(rule_id, "ci-scripts", f"{label} {entry}", fix))
@@ -199,7 +214,9 @@ def run_check(root: Path = REPO_ROOT) -> tuple[list[Violation], list[str]]:
     if findings.shellcheck is None and os.environ.get("GITHUB_ACTIONS"):
         violations.append(
             Violation(
-                _rule_for(registry, registry.ci_scripts.shellcheck_baseline),
+                _rule_for(
+                    registry, registry.ci_scripts.shellcheck_baseline, "shellcheck"
+                ),
                 "ci-scripts",
                 "shellcheck is not installed in this CI job",
                 "install it in the job (pip install shellcheck-py==<version>)",

scripts/rules/tests/test_ci_scripts.py

@@ -189,6 +189,22 @@ def test_new_finding_fails_with_its_rule_id(self) -> None:
             messages[0],
         )
 
+    def test_enforced_rule_without_baseline_keeps_its_id(self) -> None:
+        findings = Findings(multiline=set(), untested={"x.sh"}, shellcheck=set())
+        registry, _ = load_text(
+            REGISTRY.replace("ex.ci.multiline", "ex.ci.workflow-scripts-tested")
+            .replace('status = "ratcheted"', 'status = "enforced"')
+            .replace(
+                '[rule.baseline]\nfile = "rules/baselines/ci-multiline-run.txt"\ncount = 1\n',
+                "",
+            )
+        )
+        assert registry is not None
+        messages = [str(v) for v in compare(registry, findings, self.root)]
+        self.assertTrue(
+            messages[-1].startswith("[ex.ci.workflow-scripts-tested]"), messages
+        )
+
     def test_fixed_finding_must_leave_the_baseline(self) -> None:
         messages = self.messages(set())
         self.assertIn(