don-petry · Jun 17, 2026 · Jun 16, 2026 · Jun 16, 2026 · Jun 16, 2026 · Jun 17, 2026
@@ -41,7 +41,7 @@ jobs:
 
       - name: Run tests
         run: |
-          bats \
+          scripts/run-bats.sh \
             tests/fleet_report.bats \
             tests/token_report.bats \
             tests/auto_rebase_health.bats \

@@ -103,19 +103,6 @@ If `${ACTOR}` is `sonarqubecloud[bot]` and the comment reports security hotspots
 3. Fix each identified hotspot — for `curl | bash` patterns, replace with a safer alternative such as a pinned binary download with SHA verification, `gh extension install <owner>/<repo>`, or a package manager install
 4. If no hotspot is found in changed files, read any newly introduced shell scripts or workflow YAML steps for the patterns above
 
-## SonarQube / SonarCloud comments
-
-If `${ACTOR}` is `sonarqubecloud[bot]` and the comment reports security hotspots or ratings **without referencing specific files or line numbers**, the SonarCloud dashboard link is not browsable — you must infer the hotspot from the PR's changed files:
-
-1. Run `gh pr diff ${PR_NUMBER} --repo ${REPO}` to list all changed files and their diffs
-2. Scan changed files for these known SonarQube hotspot patterns (in descending severity):
-   - **Script injection (S4830 / RSPEC-4830):** `curl … | bash`, `curl … | sh`, `wget … | bash` — replace with a pinned, checksum-verified install or `gh extension install`
-   - **Hardcoded credentials:** tokens, passwords, or API keys in source files
-   - **Dynamic code execution:** `eval`, `exec` with user-controlled input
-   - **Insecure download:** HTTP (non-HTTPS) URLs used to fetch scripts or packages
-3. Fix each identified hotspot — for `curl | bash` patterns, replace with a safer alternative such as a pinned binary download with SHA verification, `gh extension install <owner>/<repo>`, or a package manager install
-4. If no hotspot is found in changed files, read any newly introduced shell scripts or workflow YAML steps for the patterns above
-
 ## Constraints
 
 - Only fix issues that are clearly actionable from the bot's output

@@ -81,27 +81,6 @@ Read every changed line as if you are a reviewer:
 4. Ask: is there a simpler fix that achieves the same result with less risk?
 5. Fix anything found, then re-run Phase 3
 
-### External quality gate (SonarCloud, CodeQL, etc.)
-
-If **Failure Logs** begins with `# External quality gate`, this check is not a GitHub Actions workflow — it is an external service that reported a quality gate failure. In this case:
-
-- **Annotations** contains the specific lines and rule messages flagged by the gate — read it carefully
-- If **Annotations** is empty, **Failure Logs** contains the PR diff to identify what the gate likely flagged
-- For **SonarQube / SonarCloud**, note: `# NOSONAR` suppresses Bugs/Code Smells but **not Security Hotspots** — hotspots require code changes or UI acknowledgment in SonarCloud
-
-Common SonarCloud Security Hotspot patterns to look for in changed files:
-
-| Pattern | Typical fix |
-|---|---|
-| `curl … \| bash` / `wget … \| sh` | Replace with pinned download + verify checksum, or `gh extension install` |
-| Hardcoded credentials / API keys | Move to secrets / env vars |
-| `eval` / `exec` with dynamic input | Remove dynamic execution or sanitize input |
-| HTTP (non-HTTPS) download URLs | Change to `https://` |
-| `npm install` without `--ignore-scripts` | Add `--ignore-scripts` if install scripts are not required; otherwise, this may require manual acknowledgment in the SonarCloud UI |
-| `npm install pkg@variable` or `@latest` | Pin to an exact version number (e.g. `pkg@1.2.3`), or exclude the file in `sonar-project.properties` if version is intentionally managed via a CI variable |
-
-- Fix each identified issue.
-
 ## Constraints
 
 - Fix only what is broken — do not refactor unrelated code