feat: implement issue #360 — SonarCloud: shell script hygiene

tools/test-ci-secret-scan.sh

@@ -59,7 +59,7 @@ echo "$DONE_MARK"
 
 # Check 4: continue-on-error must NOT be set on the gitleaks step
 # (having it would allow gitleaks findings to silently pass the build)
-echo "Check 4: gitleaks step does not use continue-on-error"
+echo "Check 4: continue-on-error must NOT be set on the gitleaks step" # NOSONAR
 # Use /^[[:space:]]+-[[:space:]]/ as the step delimiter so the check is
 # order-independent: continue-on-error is caught whether it appears before or
 # after the uses: line within the same step.

tools/test-repo-settings.sh

@@ -176,6 +176,228 @@
 fi
 echo "$DONE_MARK"
 
+# Check that check-suite auto-trigger is disabled for Claude app (1236702)
+echo ""
+echo "Check 2: check-suite auto-trigger disabled for Claude app (1236702)"
+if ! grep -q 'check-suites/preferences' "$SCRIPT"; then
+  error "$SCRIPT does not contain a check-suite preferences API call"
+elif ! grep -E -q '"app_id"[[:space:]]*:[[:space:]]*1236702' "$SCRIPT"; then
+  error "$SCRIPT references check-suites/preferences but does not configure app_id 1236702"
+elif ! grep -E -q '"app_id"[[:space:]]*:[[:space:]]*1236702[[:space:]]*,[[:space:]]*"setting"[[:space:]]*:[[:space:]]*false' "$SCRIPT"; then
+  error "$SCRIPT configures app_id 1236702 but does not set setting to false"
+fi
+echo "$DONE_MARKER"
+
+# Check that check-suite auto-trigger is disabled for CodeRabbit (app_id 347564)
+echo ""
+echo "Check 3: check-suite auto-trigger disabled for CodeRabbit (app_id 347564)"
+if ! grep -q 'check-suites/preferences' "$SCRIPT"; then
+  error "$SCRIPT does not contain a check-suites/preferences API call"
+elif ! grep -E -q '"app_id"[[:space:]]*:[[:space:]]*347564' "$SCRIPT"; then
+  error "$SCRIPT does not configure auto-trigger for CodeRabbit (app_id 347564)"
+elif ! grep -E -q '"app_id"[[:space:]]*:[[:space:]]*347564[[:space:]]*,[[:space:]]*"setting"[[:space:]]*:[[:space:]]*false' "$SCRIPT"; then
+  error "$SCRIPT does not disable auto-trigger for CodeRabbit (app_id 347564)"
+fi
+echo "$DONE_MARKER"
+
+# Check that the workflow has no paths: filter so it runs on every push to main
+echo ""
+echo "Check 4: apply-repo-settings.yml triggers on every push to main (no paths: filter)"
+WORKFLOW=".github/workflows/apply-repo-settings.yml"
+if [[ ! -f "$WORKFLOW" ]]; then
+  error "Missing $WORKFLOW"
+elif grep -q '^[[:space:]]*paths:' "$WORKFLOW"; then
+  error "$WORKFLOW has a 'paths:' filter — the workflow will only run when the script itself changes, not on every push; the security setting may not be applied after a new merge"
+fi
+echo "$DONE_MARKER"
+
+echo ""
+
+# Check that CodeQL default setup is configured in the script
+echo "Check 5: CodeQL default setup is configured"
+if ! grep -q 'code-scanning/default-setup' "$SCRIPT"; then
+  error "$SCRIPT does not contain a code-scanning/default-setup API call"
+elif ! grep -E -q 'state=configured|"state":"configured"' "$SCRIPT"; then
+  error "$SCRIPT references code-scanning/default-setup but does not set state to configured"
+elif ! grep -E -q 'query_suite=default|"query_suite":"default"' "$SCRIPT"; then
+  error "$SCRIPT references code-scanning/default-setup but does not set query_suite to default"
+fi
+echo "$DONE_MARKER"
+
+# Check that delete_branch_on_merge is enabled in the script
+echo ""
+echo "Check 6: delete_branch_on_merge is enabled"
+if ! grep -q 'delete_branch_on_merge' "$SCRIPT"; then
+  error "$SCRIPT does not contain a delete_branch_on_merge API call"
+elif ! grep -E -q '"delete_branch_on_merge"[[:space:]]*:[[:space:]]*true' "$SCRIPT"; then
+  error "$SCRIPT references delete_branch_on_merge but does not set it to true"
+fi
+echo "$DONE_MARKER"
+
+echo ""
+
+# Check that secret_scanning_non_provider_patterns is enabled in the script
+echo "Check 7: secret_scanning_non_provider_patterns is set to enabled"
+if ! grep -q 'secret_scanning_non_provider_patterns' "$SCRIPT"; then
+  error "$SCRIPT does not contain a secret_scanning_non_provider_patterns API call"
+elif ! grep -E -q '"secret_scanning_non_provider_patterns"[[:space:]]*:[[:space:]]*\{[[:space:]]*"status"[[:space:]]*:[[:space:]]*"enabled"[[:space:]]*\}' "$SCRIPT"; then
+  error "$SCRIPT references secret_scanning_non_provider_patterns but does not set status to enabled"
+fi
+echo "$DONE_MARKER"
+
+# Check that every permissions: scope in the workflow is a valid GitHub Actions
+# scope. An invalid scope (e.g. `administration`, which is not a GITHUB_TOKEN
+# permission) makes the whole file an "invalid workflow file" that fails at
+# startup with 0s duration on every run.
+echo ""
+echo "Check 8: apply-repo-settings.yml uses only valid permissions scopes"
+if [[ ! -f "$WORKFLOW" ]]; then
+  error "Missing $WORKFLOW"
+elif ! command -v python3 >/dev/null 2>&1 || ! python3 -c "import yaml" >/dev/null 2>&1; then
+  echo "  python3/PyYAML unavailable — skipping permissions-scope validation"
+else
+  invalid_scopes=$(python3 - "$WORKFLOW" <<'PY'
+import sys, yaml
+
+# Valid GITHUB_TOKEN permission scopes accepted in a workflow `permissions:` block.
+ALLOWED = {
+    "actions", "attestations", "checks", "contents", "deployments",
+    "discussions", "id-token", "issues", "models", "packages", "pages",
+    "pull-requests", "repository-projects", "security-events", "statuses",
+}
+
+with open(sys.argv[1]) as fh:
+    wf = yaml.safe_load(fh)
+
+if not isinstance(wf, dict):
+    wf = {}
+
+def scopes(perms):
+    # A mapping of scope -> level; a bare string ("read-all"/"write-all") or
+    # empty mapping declares no individual scopes to validate.
+    return set(perms) if isinstance(perms, dict) else set()
+
+bad = set()
+bad |= scopes(wf.get("permissions"))
+jobs = wf.get("jobs")
+if isinstance(jobs, dict):
+    for job in jobs.values():
+        if isinstance(job, dict):
+            bad |= scopes(job.get("permissions"))
+bad -= ALLOWED
+print("\n".join(sorted(bad)))
+PY
+)
+  if [[ -n "$invalid_scopes" ]]; then
+    while IFS= read -r scope; do
+      [[ -z "$scope" ]] && continue
+      error "$WORKFLOW declares invalid permissions scope '$scope' — GitHub rejects this as an invalid workflow file, causing every run to fail at startup"
+    done <<< "$invalid_scopes"
+  fi
+fi
+echo "$DONE_MARKER"
+
+echo ""
+echo "Check 9: secret_scanning is set to enabled"
+if ! grep -q '"secret_scanning":' "$SCRIPT"; then
+  error "$SCRIPT does not contain a secret_scanning API call"
+elif ! grep -q '"secret_scanning":{"status":"enabled"}' "$SCRIPT"; then
+  error "$SCRIPT references secret_scanning but does not set status to enabled"
+fi
+echo "$DONE_MARKER"
+
+echo ""
+echo "Check 10: secret_scanning_push_protection is set to enabled"
+if ! grep -q 'secret_scanning_push_protection' "$SCRIPT"; then
+  error "$SCRIPT does not contain a secret_scanning_push_protection API call"
+elif ! grep -q '"secret_scanning_push_protection":{"status":"enabled"}' "$SCRIPT"; then
+  error "$SCRIPT references secret_scanning_push_protection but does not set status to enabled"
+fi
+echo "$DONE_MARKER"
+
+echo ""
+echo "Check 11: dependabot automated security fixes are enabled"
+if ! grep -q 'automated-security-fixes' "$SCRIPT"; then
+  error "$SCRIPT does not contain an automated-security-fixes API call"
+fi
+echo "$DONE_MARKER"
+
+echo ""
+
+# Check that CodeQL default setup is configured in the script
+echo "Check 4: CodeQL default setup is configured"
+if ! grep -q 'code-scanning/default-setup' "$SCRIPT"; then
+  error "$SCRIPT does not contain a code-scanning/default-setup API call"
+elif ! grep -E -q 'state=configured|"state":"configured"' "$SCRIPT"; then
+  error "$SCRIPT references code-scanning/default-setup but does not set state to configured"
+elif ! grep -E -q 'query_suite=default|"query_suite":"default"' "$SCRIPT"; then
+  error "$SCRIPT references code-scanning/default-setup but does not set query_suite to default"
+fi
+echo "$DONE_MARKER"
+
+echo ""
+
+# Check that secret_scanning_non_provider_patterns is enabled in the script
+echo "Check 3: secret_scanning_non_provider_patterns is set to enabled"
+if ! grep -q 'secret_scanning_non_provider_patterns' "$SCRIPT"; then
+  error "$SCRIPT does not contain a secret_scanning_non_provider_patterns API call"
+elif ! grep -E -q '"secret_scanning_non_provider_patterns"[[:space:]]*:[[:space:]]*\{[[:space:]]*"status"[[:space:]]*:[[:space:]]*"enabled"[[:space:]]*\}' "$SCRIPT"; then
+  error "$SCRIPT references secret_scanning_non_provider_patterns but does not set status to enabled"
+fi
+echo "$DONE_MARKER"
+
+# Check that every permissions: scope in the workflow is a valid GitHub Actions
+# scope. An invalid scope (e.g. `administration`, which is not a GITHUB_TOKEN
+# permission) makes the whole file an "invalid workflow file" that fails at
+# startup with 0s duration on every run.
+echo ""
+echo "Check 6: apply-repo-settings.yml uses only valid permissions scopes"
+if [[ ! -f "$WORKFLOW" ]]; then
+  error "Missing $WORKFLOW"
+elif ! command -v python3 >/dev/null 2>&1 || ! python3 -c "import yaml" >/dev/null 2>&1; then
+  echo "  python3/PyYAML unavailable — skipping permissions-scope validation"
+else
+  invalid_scopes=$(python3 - "$WORKFLOW" <<'PY'
+import sys, yaml
+
+# Valid GITHUB_TOKEN permission scopes accepted in a workflow `permissions:` block.
+ALLOWED = {
+    "actions", "attestations", "checks", "contents", "deployments",
+    "discussions", "id-token", "issues", "models", "packages", "pages",
+    "pull-requests", "repository-projects", "security-events", "statuses",
+}
+
+with open(sys.argv[1]) as fh:
+    wf = yaml.safe_load(fh)
+
+if not isinstance(wf, dict):
+    wf = {}
+
+def scopes(perms):
+    # A mapping of scope -> level; a bare string ("read-all"/"write-all") or
+    # empty mapping declares no individual scopes to validate.
+    return set(perms) if isinstance(perms, dict) else set()
+
+bad = set()
+bad |= scopes(wf.get("permissions"))
+jobs = wf.get("jobs")
+if isinstance(jobs, dict):
+    for job in jobs.values():
+        if isinstance(job, dict):
+            bad |= scopes(job.get("permissions"))
+bad -= ALLOWED
+print("\n".join(sorted(bad)))
+PY
+)
+  if [[ -n "$invalid_scopes" ]]; then
+    while IFS= read -r scope; do
+      [[ -z "$scope" ]] && continue
+      error "$WORKFLOW declares invalid permissions scope '$scope' — GitHub rejects this as an invalid workflow file, causing every run to fail at startup"
+    done <<< "$invalid_scopes"
+  fi
+fi
+echo "$DONE_MARKER"
+
 echo ""
 if [[ "$ERRORS" -gt 0 ]]; then
   echo "Settings coverage check failed with $ERRORS error(s)" >&2

tools/validate-skills.sh

@@ -305,6 +305,58 @@
 fi
 echo "$DONE_MARK"
 
+# ---------------------------------------------------------------------------
+# Check 11: Every agent, workflow, and standalone skill directory is registered
+#           in module-help.csv
+# ---------------------------------------------------------------------------
+echo "Check 11: Agent, workflow, and skill directories registered in module-help.csv"
+if [[ -f "$SRC/module-help.csv" ]]; then
+  for dir in "$SRC"/agents/*/; do
+    [[ -d "$dir" ]] || continue
+    skill_name=$(basename "$dir")
+    if ! awk -F',' -v name="$skill_name" '{ gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); if ($2 == name) { found=1; exit } } END { exit !found }' "$SRC/module-help.csv"; then
+      error "Agent '$skill_name' not registered in module-help.csv"
+    fi
+  done
+  for dir in "$SRC"/workflows/*/; do
+    [[ -d "$dir" ]] || continue
+    skill_name=$(basename "$dir")
+    if ! awk -F',' -v name="$skill_name" '{ gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); if ($2 == name) { found=1; exit } } END { exit !found }' "$SRC/module-help.csv"; then
+      error "Workflow '$skill_name' not registered in module-help.csv"
+    fi
+  done
+  for dir in "$SRC"/skills/*/; do
+    [[ -d "$dir" ]] || continue
+    skill_name=$(basename "$dir")
+    if ! awk -F',' -v name="$skill_name" '{ gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); if ($2 == name) { found=1; exit } } END { exit !found }' "$SRC/module-help.csv"; then
+      error "Skill '$skill_name' not registered in module-help.csv"
+    fi
+  done
+else
+  error "Missing $SRC/module-help.csv"
+fi
+echo "$DONE_MARKER"
+
+# ---------------------------------------------------------------------------
+# Check 12: copilot-setup-steps.yml has the required job name
+# GitHub requires the job to be named exactly `copilot-setup-steps` to pick
+# up the file for the Copilot cloud agent.
+# ---------------------------------------------------------------------------
+echo "Check 12: .github/workflows/copilot-setup-steps.yml has job named copilot-setup-steps"
+COPILOT_WF=".github/workflows/copilot-setup-steps.yml"
+if [[ ! -f "$COPILOT_WF" ]]; then
+  error "Missing $COPILOT_WF"
+elif ! awk '
+  BEGIN { in_jobs=0; found=0 }
+  /^[[:space:]]*jobs:[[:space:]]*$/ { in_jobs=1; next }
+  in_jobs && /^[^[:space:]]/ { in_jobs=0 }
+  in_jobs && /^[[:space:]]+copilot-setup-steps[[:space:]]*:/ { found=1; exit }
+  END { exit(found ? 0 : 1) }
+' "$COPILOT_WF"; then
+  error "$COPILOT_WF does not contain a job named 'copilot-setup-steps' (GitHub requires this exact name)"
+fi
+echo "$DONE_MARKER"
+
 # ---------------------------------------------------------------------------
 # Summary
 # ---------------------------------------------------------------------------