Skip to content

fix(ci): the invisible-character gate never matched anything - #63

Open
hyperpolymath wants to merge 1 commit into
mainfrom
fix/empty-linter-pattern-never-matched
Open

fix(ci): the invisible-character gate never matched anything#63
hyperpolymath wants to merge 1 commit into
mainfrom
fix/empty-linter-pattern-never-matched

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Measured 2026-08-27: this gate caught 0 of 6 invisible-character test cases. It has never detected an NBSP, zero-width space, BOM, soft hyphen, bidi override or word joiner.

Root cause

The pattern used UTF-8 byte sequences (\xc2\xa0) while grep -P matches characters. Bytes c2 a0 are one character U+00A0; \xc2\xa0 asks for two, U+00C2 then U+00A0 — never present.

grep -P '\xc2\xa0'  ->  miss
grep -P '\x{a0}'    ->  MATCH

Only \x00 worked, being single-byte in both readings. The gate ran, passed, and could not see what it exists to see.

Fixed

  • codepoint escapes in place of byte sequences
  • C0 controls \x01-\x08,\x0B,\x0C,\x0E-\x1F added (TAB/LF/CR excluded)
  • grep -a — without it grep skips any NUL-bearing file as binary

The C0 range matters: a stray backspace byte made a workflow unparseable in developer-ecosystem, so it never ran — and this linter called it clean.

Canonical fix: hyperpolymath/empty-linter#70. 1 file(s) here.

Verified: YAML re-parsed, and the corrected pattern was confirmed to catch a real NBSP before the change was kept.

MEASURED 2026-08-27: this gate's pattern caught 0 OF 6 invisible-character test
cases. It has never detected an NBSP, zero-width space, BOM, soft hyphen, bidi
override or word joiner.

ROOT CAUSE: the pattern used UTF-8 BYTE sequences (\xc2\xa0) while grep -P
matches CHARACTERS. Bytes c2 a0 are ONE character U+00A0; \xc2\xa0 asks for TWO
characters, U+00C2 then U+00A0, which is never present.

  grep -P '\xc2\xa0'  ->  miss
  grep -P '\x{a0}'    ->  MATCH

Only \x00 worked, being single-byte in both readings.

FIXED: codepoint escapes; C0 control characters \x01-\x08,\x0B,\x0C,\x0E-\x1F
added (TAB/LF/CR excluded); and grep -a, without which grep skips any NUL-bearing
file as binary.

The C0 range matters: a stray BACKSPACE byte made a workflow unparseable in
developer-ecosystem, so it never ran, and this linter called it clean.

Canonical fix: hyperpolymath/empty-linter#70. 1 file(s) here.
VERIFIED: YAML re-parsed, and the corrected pattern was confirmed to catch a real
NBSP before the change was kept.
@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

Run reviewer

TIP This summary will be updated as you push new changes.

@coderabbitai

coderabbitai Bot commented Aug 27, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 85585b60-6725-4e94-9719-17cec8930f79

📥 Commits

Reviewing files that changed from the base of the PR and between 13c2024 and c4ea43f.

📒 Files selected for processing (1)
  • .github/workflows/dogfood-gate.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (1)
  • GitHub Check: Codacy Static Code Analysis
⚠️ CI failures not shown inline (4)

GitHub Actions: Workflow Security Linter / 0_lint-workflows.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run errors=0
 �[36;1merrors=0�[0m
 �[36;1mfor f in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$f" ] || continue�[0m
 �[36;1m  if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then�[0m
 �[36;1m    echo "ERROR: $f missing SPDX header"�[0m
 �[36;1m    errors=$((errors + 1))�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1mexit $errors�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ERROR: .github/workflows/main-estate-audit.yml missing SPDX header
 ##[error]Process completed with exit code 1.

GitHub Actions: Central Estate CI/CD Audit / 0_estate-audit.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run # Presence-only checking rewards filler. This gate previously demanded
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- presence, accepting every policy-legal form -------------------�[0m
 �[36;1m# "name:form1,form2,..." — first existing form wins.�[0m
 �[36;1mdeclare -a required=(�[0m
 �[36;1m  ".editorconfig:.editorconfig"�[0m
 �[36;1m  ".gitignore:.gitignore"�[0m
 �[36;1m  ".gitattributes:.gitattributes"�[0m
 �[36;1m  "CODEOWNERS:CODEOWNERS,.github/CODEOWNERS,docs/CODEOWNERS"�[0m
 �[36;1m  "GOVERNANCE:GOVERNANCE.adoc,GOVERNANCE.md"�[0m
 �[36;1m  "ARCHITECTURE:ARCHITECTURE.adoc,ARCHITECTURE.md,docs/architecture/README.adoc,TOPOLOGY.adoc,TOPOLOGY.md"�[0m
 �[36;1m  "MAINTAINERS:MAINTAINERS,MAINTAINERS.adoc,MAINTAINERS.md"�[0m
 �[36;1m  "toolchain:.tool-versions,mise.toml"�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1mdeclare -A found=()�[0m
 �[36;1...

GitHub Actions: Workflow Security Linter / lint-workflows: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run errors=0
 �[36;1merrors=0�[0m
 �[36;1mfor f in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$f" ] || continue�[0m
 �[36;1m  if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then�[0m
 �[36;1m    echo "ERROR: $f missing SPDX header"�[0m
 �[36;1m    errors=$((errors + 1))�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1mexit $errors�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ERROR: .github/workflows/main-estate-audit.yml missing SPDX header
 ##[error]Process completed with exit code 1.

GitHub Actions: Central Estate CI/CD Audit / estate-audit: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run # Presence-only checking rewards filler. This gate previously demanded
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- presence, accepting every policy-legal form -------------------�[0m
 �[36;1m# "name:form1,form2,..." — first existing form wins.�[0m
 �[36;1mdeclare -a required=(�[0m
 �[36;1m  ".editorconfig:.editorconfig"�[0m
 �[36;1m  ".gitignore:.gitignore"�[0m
 �[36;1m  ".gitattributes:.gitattributes"�[0m
 �[36;1m  "CODEOWNERS:CODEOWNERS,.github/CODEOWNERS,docs/CODEOWNERS"�[0m
 �[36;1m  "GOVERNANCE:GOVERNANCE.adoc,GOVERNANCE.md"�[0m
 �[36;1m  "ARCHITECTURE:ARCHITECTURE.adoc,ARCHITECTURE.md,docs/architecture/README.adoc,TOPOLOGY.adoc,TOPOLOGY.md"�[0m
 �[36;1m  "MAINTAINERS:MAINTAINERS,MAINTAINERS.adoc,MAINTAINERS.md"�[0m
 �[36;1m  "toolchain:.tool-versions,mise.toml"�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1mdeclare -A found=()�[0m
 �[36;1...
🔇 Additional comments (1)
.github/workflows/dogfood-gate.yml (1)

112-112: 🎯 Functional Correctness

Do not add a separate leading-BOM check.

GNU grep does not strip a leading UTF-8 BOM. The stated failure mechanism is incorrect. With GNU grep 3.8, this pattern instead exits with 2 and reports character code point value in \x{} or \o{} is too large.


📝 Walkthrough

Summary by CodeRabbit

  • Bug Fixes
    • Improved detection of invisible Unicode characters, including in files treated as binary.
    • Empty-character scans now produce more reliable results.

Walkthrough

The dogfood gate now detects invisible characters with Unicode code-point patterns. It also scans binary files as text.

Changes

Invisible-character gate

Layer / File(s) Summary
Unicode scan update
.github/workflows/dogfood-gate.yml
The scan replaces byte-encoded patterns with Unicode code-point expressions and forces grep to process binary files as text.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to c4ea4

This localized workflow change makes the invisible-character gate match Unicode code points and C0 controls, including NUL-bearing files. No actionable merge-blocking risk remains after normal checks.

Poem

A rabbit checks each hidden mark
Unicode guides the gate through dark
Binary files now join the scan
Each quiet code point shows its plan
The workflow hops, clean and bright

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Linked Issues check ⚠️ Warning The change covers codepoint escapes, C0 control detection, and grep -a as required by issue #70. The provided summary does not show the required separate leading-BOM check, compiled linter alignment, … Add and verify the separate byte-wise leading-BOM check. Update the compiled linter and configuration with the same C0-control behaviour. Correct all required estate-wide copies, or document why those changes are out of scope for this pull …
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the primary change: fixing the CI gate for invisible characters.
Description check ✅ Passed The description directly explains the invisible-character detection failure, its cause, and the proposed CI fixes.
Out of Scope Changes check ✅ Passed The reported changes are limited to the CI invisible-character gate and are related to issue #70. No unrelated changes are identified.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Full details: Linked Issues check

Explanation

The change covers codepoint escapes, C0 control detection, and grep -a as required by issue #70. The provided summary does not show the required separate leading-BOM check, compiled linter alignment, or updates to the estate-wide copies.

Resolution

Add and verify the separate byte-wise leading-BOM check. Update the compiled linter and configuration with the same C0-control behaviour. Correct all required estate-wide copies, or document why those changes are out of scope for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@gitar-bot

gitar-bot Bot commented Aug 27, 2026

Copy link
Copy Markdown

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

Gitar

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant