c184fd55ea
All checks were successful
PR build (required check) / changes (pull_request) Successful in 11s
secrets-guard / encrypted (pull_request) Successful in 10s
shell-lint / shellcheck (pull_request) Successful in 14s
PR build (required check) / build-backend (pull_request) Has been skipped
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / gate (pull_request) Successful in 3s
shell-lint flagged the literal `$(` / backtick patterns the read-only classifier searches for inside a command string. Expanding them is exactly what must not happen — the check exists to refuse commands containing command substitution, so the single quotes are the point. Same treatment and rationale as the existing disables in render-secrets.sh and verify-centralis-render.sh. Verified with the pinned shellcheck v0.11.0 (sha256 matching shell-lint.yml): all 34 scripts in the tree clean. Hook behaviour unchanged — the classifier test matrix still allows reads and asks on mutations and compound smuggling. Also documents that ~/.claude/hooks/ carries a mirror of prod-guard.sh so sessions started outside this repo are covered, and that the blanket ssh allow rules were removed from global settings so the hook cannot be out-ranked. |
||
|---|---|---|
| .. | ||
| hooks | ||
| settings.json | ||