From 71a4287d803f6d69850d221358bfe7d7f5ab4888 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Tue, 13 Oct 2026 21:55:45 +0000
Subject: [PATCH] =?UTF-8?q?feat:=20implement=20issue=20#505=20=E2=80=94=20?=
 =?UTF-8?q?SonarCloud:=20shell=20script=20hygiene?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/scripts/apply-code-quality-ruleset.sh               | 6 +++---
 .github/scripts/apply-pr-quality-ruleset.sh                 | 4 ++--
 .github/scripts/apply-repo-settings.sh                      | 2 +-
 .github/scripts/apply-secret-scanning-ai-detection.sh       | 2 +-
 .../scripts/apply-secret-scanning-non-provider-patterns.sh  | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/scripts/apply-code-quality-ruleset.sh b/.github/scripts/apply-code-quality-ruleset.sh
index 932f64e6..8dda1597 100755
--- a/.github/scripts/apply-code-quality-ruleset.sh
+++ b/.github/scripts/apply-code-quality-ruleset.sh
@@ -31,7 +31,7 @@ set -euo pipefail
 REPO="petry-projects/markets"
 RULESET_NAME="code-quality"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi
@@ -52,7 +52,7 @@ REQUIRED_BYPASS_ACTORS=$(jq -n \
 
 # When updating an existing ruleset, fetch its current bypass actors and merge them
 # with the required actors so that other legitimate bypass actors are not silently removed.
-if [ -n "$EXISTING_ID" ]; then
+if [[ -n "$EXISTING_ID" ]]; then
   EXISTING_BYPASS=$(gh api "repos/$REPO/rulesets/$EXISTING_ID" \
     --jq '.bypass_actors // []' 2>/dev/null || echo "[]")
   BYPASS_ACTORS=$(echo "$EXISTING_BYPASS" | \
@@ -92,7 +92,7 @@ PAYLOAD=$(jq -n --argjson bypass_actors "$BYPASS_ACTORS" '{
   bypass_actors: $bypass_actors
 }')
 
-if [ -n "$EXISTING_ID" ]; then
+if [[ -n "$EXISTING_ID" ]]; then
   echo "Updating existing $RULESET_NAME ruleset (id=$EXISTING_ID) ..."
   echo "$PAYLOAD" | gh api -X PUT "repos/$REPO/rulesets/$EXISTING_ID" --input - > /dev/null
   echo "Done — ruleset updated: https://github.com/$REPO/rules/$EXISTING_ID"
diff --git a/.github/scripts/apply-pr-quality-ruleset.sh b/.github/scripts/apply-pr-quality-ruleset.sh
index a15c0a52..c801df0f 100755
--- a/.github/scripts/apply-pr-quality-ruleset.sh
+++ b/.github/scripts/apply-pr-quality-ruleset.sh
@@ -36,7 +36,7 @@ set -euo pipefail
 REPO="petry-projects/markets"
 RULESET_NAME="pr-quality"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi
@@ -83,7 +83,7 @@ PAYLOAD=$(jq -n '{
   ]
 }')
 
-if [ -n "$EXISTING_ID" ]; then
+if [[ -n "$EXISTING_ID" ]]; then
   echo "Updating existing $RULESET_NAME ruleset (id=$EXISTING_ID) ..."
   echo "$PAYLOAD" | gh api -X PUT "repos/$REPO/rulesets/$EXISTING_ID" --input - > /dev/null
   echo "Done — ruleset updated: https://github.com/$REPO/rules/$EXISTING_ID"
diff --git a/.github/scripts/apply-repo-settings.sh b/.github/scripts/apply-repo-settings.sh
index 2f2d9c09..657f86ed 100755
--- a/.github/scripts/apply-repo-settings.sh
+++ b/.github/scripts/apply-repo-settings.sh
@@ -15,7 +15,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO="petry-projects/markets"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi
diff --git a/.github/scripts/apply-secret-scanning-ai-detection.sh b/.github/scripts/apply-secret-scanning-ai-detection.sh
index 5ea01cc9..54177761 100755
--- a/.github/scripts/apply-secret-scanning-ai-detection.sh
+++ b/.github/scripts/apply-secret-scanning-ai-detection.sh
@@ -22,7 +22,7 @@ set -euo pipefail
 
 REPO="petry-projects/markets"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi
diff --git a/.github/scripts/apply-secret-scanning-non-provider-patterns.sh b/.github/scripts/apply-secret-scanning-non-provider-patterns.sh
index 109cac55..f0b88539 100755
--- a/.github/scripts/apply-secret-scanning-non-provider-patterns.sh
+++ b/.github/scripts/apply-secret-scanning-non-provider-patterns.sh
@@ -22,7 +22,7 @@ set -euo pipefail
 
 REPO="petry-projects/markets"
 
-if [ -z "${GH_TOKEN:-}" ]; then
+if [[ -z "${GH_TOKEN:-}" ]]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
   exit 1
 fi