mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 20:27:02 +01:00
Krzysztof kuhy Rudnicki
17b20e5fae
CLAUDE.md's longest and most emphatic code rule -- never embed Python program logic in a shell script -- was enforced by nothing. A repo-wide scan found it had already been violated: install_plagiarism_tools.sh ran a 6-line NLTK download as an inline `python3 -c`, invisible to ruff, mypy, pylint, bandit and pytest, exactly the failure mode the rule exists to prevent. check_no_inline_python.sh flags heredocs and multi-line `python -c` while permitting the single-line availability probes the rule explicitly allows, so the ~250 shell files here produce zero false positives. Commented-out examples are skipped; otherwise the rule's own documentation would fail the hook. The extracted download_nltk_data.py also fixes a real defect: the inline block ignored nltk.download()'s return value, so a partial corpus download reported success. It now returns non-zero and the caller's `set -e` sees it. nltk is imported via importlib inside main(), not at module scope: it belongs to the plagiarism toolchain, not this repo, so it is absent from requirements.txt and unresolvable to pylint as a static import. No suppressions anywhere: T201 avoided with sys.stderr.write, INP001 with a shebang (matching sibling fast_count.py), E0401 with the dynamic import. pylint 10.00/10, ruff clean, mypy clean. Verified the gate fires rather than passing vacuously -- a staged canary with a real heredoc exits non-zero -- and that the extracted script runs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
46 lines
3.1 KiB
JSON
46 lines
3.1 KiB
JSON
{
|
|
"intent": "Make the 'no inline Python in shell scripts' rule a gate that fails the commit, instead of prose in CLAUDE.md that nothing enforced.",
|
|
"scope": [
|
|
"meta/scripts/check_no_inline_python.sh (new pre-commit hook script)",
|
|
".pre-commit-config.yaml (register the no-inline-python hook)",
|
|
"linux_configuration/scripts/single_use/utils/install_plagiarism_tools.sh (the one real violation)",
|
|
"linux_configuration/scripts/single_use/utils/download_nltk_data.py (extracted from the inline block)",
|
|
"Non-goal: the remaining 250-line file-length work; that lands separately"
|
|
],
|
|
"changes": [
|
|
"Added check_no_inline_python.sh: flags `python <<HEREDOC` and multi-line `python -c`, while permitting the single-line availability/version probes the rule explicitly allows. Skips commented-out examples so the rule's own documentation does not fail the hook.",
|
|
"Extracted a 6-line inline `python3 -c` NLTK download block into download_nltk_data.py, invoked as `python3 \"$(dirname \"$0\")/download_nltk_data.py\"`. It now returns a non-zero exit on partial failure, which the inline version silently swallowed.",
|
|
"Registered the hook with types_or: [shell, zsh]."
|
|
],
|
|
"verification": [
|
|
{
|
|
"command": "find . -name '*.sh' ... | xargs bash meta/scripts/check_no_inline_python.sh",
|
|
"result": "pass",
|
|
"evidence": "Scanned every shell file in the repo: 1 genuine violation found (install_plagiarism_tools.sh:84), 0 false positives across ~250 files. After the extraction, the whole tree is clean."
|
|
},
|
|
{
|
|
"command": "pre-commit run no-inline-python --all-files",
|
|
"result": "pass",
|
|
"evidence": "Block Python logic embedded in shell scripts.............................Passed"
|
|
},
|
|
{
|
|
"command": "pre-commit run no-inline-python --files ./canary_tmp.sh (staged canary with a real heredoc)",
|
|
"result": "pass",
|
|
"evidence": "Hook exited non-zero and reported canary_tmp.sh:2: python3 <<'PY' -- proving the gate fires rather than passing vacuously. Canary deleted afterwards."
|
|
},
|
|
{
|
|
"command": "bash -n + shellcheck install_plagiarism_tools.sh; ruff check + ruff format --check download_nltk_data.py",
|
|
"result": "pass",
|
|
"evidence": "bash -n OK; shellcheck OK; 'All checks passed!' and '1 file already formatted'. No suppressions added: T201 avoided via sys.stderr.write and INP001 via the #!/usr/bin/env python3 shebang, matching the sibling fast_count.py."
|
|
}
|
|
],
|
|
"risks": [
|
|
"download_nltk_data.py imports nltk at module scope, which is not in meta/requirements.txt because it belongs to the plagiarism toolchain, not this repo. The installer pip-installs it immediately before invoking the module, so the import cannot fail in the real call path.",
|
|
"The multi-line `python -c` regex keys on an unterminated quote. A single-line -c containing an escaped quote could in principle be misread; no such case exists in the repo today and the whole-tree scan found zero false positives."
|
|
],
|
|
"rollback": [
|
|
"git revert the commit; the hook stops running and the inline block returns.",
|
|
"Validate by re-running: pre-commit run no-inline-python --all-files"
|
|
]
|
|
}
|