From 0e5cc33788cfd6cf47d2c6adffc18adb098f2def Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 10 Aug 2026 11:06:23 +0000 Subject: [PATCH 1/2] Initial plan From 6b20aba1ca5206b9ffa524a7f13fb7161998a2e7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 10 Aug 2026 11:20:12 +0000 Subject: [PATCH 2/2] Suppress intentional SC2016 config literals Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .../workflows/daily-arxiv-researcher.lock.yml | 2 ++ .github/workflows/daily-code-metrics.lock.yml | 2 ++ .github/workflows/smoke-crush.lock.yml | 2 ++ pkg/workflow/behavior_defined_engine.go | 8 +++++-- .../behavior_defined_engine_harness_test.go | 24 +++++++++++++++++++ 5 files changed, 36 insertions(+), 2 deletions(-) diff --git a/.github/workflows/daily-arxiv-researcher.lock.yml b/.github/workflows/daily-arxiv-researcher.lock.yml index 3bbec127b05..a0aadf1c662 100644 --- a/.github/workflows/daily-arxiv-researcher.lock.yml +++ b/.github/workflows/daily-arxiv-researcher.lock.yml @@ -848,6 +848,7 @@ jobs: umask 077 mkdir -p "$(dirname "$GITHUB_WORKSPACE/.crush.json")" CONFIG="$GITHUB_WORKSPACE/.crush.json" + # shellcheck disable=SC2016 BASE_CONFIG='{ "$schema": "https://charm.land/crush.json", "options": { @@ -1643,6 +1644,7 @@ jobs: umask 077 mkdir -p "$(dirname "$GITHUB_WORKSPACE/.crush.json")" CONFIG="$GITHUB_WORKSPACE/.crush.json" + # shellcheck disable=SC2016 BASE_CONFIG='{ "$schema": "https://charm.land/crush.json", "options": { diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml index 6b27c30ef57..4e63cd4d64e 100644 --- a/.github/workflows/daily-code-metrics.lock.yml +++ b/.github/workflows/daily-code-metrics.lock.yml @@ -959,6 +959,7 @@ jobs: umask 077 mkdir -p "$(dirname "$GITHUB_WORKSPACE/.crush.json")" CONFIG="$GITHUB_WORKSPACE/.crush.json" + # shellcheck disable=SC2016 BASE_CONFIG='{ "$schema": "https://charm.land/crush.json", "options": { @@ -1982,6 +1983,7 @@ jobs: umask 077 mkdir -p "$(dirname "$GITHUB_WORKSPACE/.crush.json")" CONFIG="$GITHUB_WORKSPACE/.crush.json" + # shellcheck disable=SC2016 BASE_CONFIG='{ "$schema": "https://charm.land/crush.json", "options": { diff --git a/.github/workflows/smoke-crush.lock.yml b/.github/workflows/smoke-crush.lock.yml index e39fe9cdbf2..4f87f8705fd 100644 --- a/.github/workflows/smoke-crush.lock.yml +++ b/.github/workflows/smoke-crush.lock.yml @@ -980,6 +980,7 @@ jobs: umask 077 mkdir -p "$(dirname "$GITHUB_WORKSPACE/.crush.json")" CONFIG="$GITHUB_WORKSPACE/.crush.json" + # shellcheck disable=SC2016 BASE_CONFIG='{ "$schema": "https://charm.land/crush.json", "options": { @@ -1871,6 +1872,7 @@ jobs: umask 077 mkdir -p "$(dirname "$GITHUB_WORKSPACE/.crush.json")" CONFIG="$GITHUB_WORKSPACE/.crush.json" + # shellcheck disable=SC2016 BASE_CONFIG='{ "$schema": "https://charm.land/crush.json", "options": { diff --git a/pkg/workflow/behavior_defined_engine.go b/pkg/workflow/behavior_defined_engine.go index a623c920358..87a5f672e7f 100644 --- a/pkg/workflow/behavior_defined_engine.go +++ b/pkg/workflow/behavior_defined_engine.go @@ -674,17 +674,21 @@ func (e *BehaviorDefinedEngine) buildConfigFileStep() GitHubActionStep { return nil } config := behavior.ConfigFile + shellcheckDirective := "" + if strings.Contains(config.Content, "$") { + shellcheckDirective = "# shellcheck disable=SC2016\n" + } command := fmt.Sprintf(`umask 077 mkdir -p "$(dirname "$GITHUB_WORKSPACE/%s")" CONFIG="$GITHUB_WORKSPACE/%s" -BASE_CONFIG='%s' +%sBASE_CONFIG='%s' if [ -f "$CONFIG" ]; then MERGED=$(jq -n --argjson base "$BASE_CONFIG" --argjson existing "$(cat "$CONFIG")" '$existing * $base') echo "$MERGED" > "$CONFIG" else echo "$BASE_CONFIG" > "$CONFIG" fi -chmod 600 "$CONFIG"`, config.Path, config.Path, config.Content) +chmod 600 "$CONFIG"`, config.Path, config.Path, shellcheckDirective, config.Content) if config.MergeStrategy != behaviorConfigMergeJSON { command = fmt.Sprintf(`umask 077 mkdir -p "$(dirname "$GITHUB_WORKSPACE/%s")" diff --git a/pkg/workflow/behavior_defined_engine_harness_test.go b/pkg/workflow/behavior_defined_engine_harness_test.go index e1d8cf41355..60ec6f2d5c2 100644 --- a/pkg/workflow/behavior_defined_engine_harness_test.go +++ b/pkg/workflow/behavior_defined_engine_harness_test.go @@ -208,6 +208,30 @@ func TestBehaviorDefinedEngineNoHarnessScript(t *testing.T) { assert.NotContains(t, execStepContent, "GHAW_HARNESS_SCRIPT_EOF", "no harness write step should be present") } +func TestBehaviorDefinedEngineConfigFileDisablesSC2016(t *testing.T) { + def := &EngineDefinition{ + ID: "config", + DisplayName: "Config", + Behaviors: &EngineBehaviorDefinition{ + ConfigFile: &EngineConfigFileDefinition{ + Path: ".config.json", + StepName: "Write Config", + Content: `{"$schema":"https://example.com/schema.json"}`, + MergeStrategy: behaviorConfigMergeJSON, + }, + }, + } + engine, err := NewBehaviorDefinedEngine(def) + require.NoError(t, err) + + step := strings.Join(engine.buildConfigFileStep(), "\n") + assert.Contains(t, step, "# shellcheck disable=SC2016\n BASE_CONFIG=") + + def.Behaviors.ConfigFile.Content = `{"option":true}` + step = strings.Join(engine.buildConfigFileStep(), "\n") + assert.NotContains(t, step, "# shellcheck disable=SC2016") +} + // TestBehaviorDefinedEngineRenderMCPConfig verifies that the MCP gateway startup command // is always emitted, even for engines that declare no behaviors.mcp.config-path (e.g. // engines with `mcp: false`). Skipping it would leave the gateway container unstarted