perf(shellcheck): batch pre-commit script checks - #247
Merged
Conversation
### Summary Run ShellCheck once for all matching tracked text scripts instead of starting one process per file. Preserve the existing severity, file-list membership, output, and failure behavior while making the empty-script case an explicit no-op. Add structural generated-hook coverage for invocation count and argument safety. ### Details Build a Bash array by reading the existing newline-delimited `FLAKEBOX_GIT_LS_TEXT` representation and selecting `.sh` suffixes. Quoted array expansion preserves spaces and glob characters, then passes `--severity=warning` and all paths to one ShellCheck process. This intentionally does not redesign the generic file-list representation, add NUL transport, or add ARG_MAX chunking. Use a fake ShellCheck in the generated-hook integration check to prove zero scripts causes no invocation, two scripts cause exactly one invocation with exact argv, and a failing ShellCheck still fails the generated hook. An untracked path matching a tracked literal bracket expression makes unsafe pathname expansion fail the test. Regenerate the checked-in pre-commit artifact and Flakebox root identity. ### Reviews An independent review found that the initial bracketed-path fixture had no matching directory entry and therefore could not detect unsafe pathname expansion. The strengthened fixture adds an untracked matching path while tracking the bracketed name with literal Git pathspec semantics. Follow-up review passed with no findings. ### Validation - `nix develop -c treefmt` - focused `gitHooks` Nix check - `nix develop -c selfci check` - `nix develop -c selfci check --candidate swkkprpu`
dpc
marked this pull request as ready for review
July 24, 2026 23:21
dpc
added a commit
that referenced
this pull request
Jul 30, 2026
perf(shellcheck): batch pre-commit script checks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Posted by Tau
Summary
Batch generated pre-commit ShellCheck work into one process while preserving the existing tracked-text script selection, severity, output, and failure behavior.
Details
The generated check reads the existing newline-delimited
FLAKEBOX_GIT_LS_TEXTinto a quoted Bash array, selects.shsuffixes, and invokesshellcheck --severity=warningonce with all matching paths. Zero matching scripts remains a successful no-op. Spaces and glob characters remain literal within the current file-list representation.Generated-hook tests use a fake ShellCheck to prove zero invocations for zero scripts, exactly one invocation and exact argv for multiple scripts, and hook failure when ShellCheck fails. A matching untracked pathname makes the glob-safety assertion structural rather than timing-based.