Define walk in the filter rather than calling it, for jq 1.5

[ptr727]

Closes#549, raised by the Blog agent from a Copilot review on a downstream re-vendor and declined there because configure.sh is carried verbatim.

The defect

The payload-driven ruleset comparison added in #540 built its normalizer on walk/1, which arrived in jq 1.6. On a host carrying jq 1.5 the filter does not degrade — it fails to compile, so check_ruleset reports drift on every parameterized rule it never actually compared.

That is the inverse of the false clean #540 was written to close, and arguably worse: a false failure teaches an operator to distrust the tool, where a false pass merely fails to warn them.

Verified on a real jq 1.5, not argued

jq version: jq-1.5-1-a5b5cbe--- OLD filter (calls walk):def n: walk(if type=="array" then sort else . end); njq: 1 compile error--- NEW filter (defines its own):{"allowed_merge_methods":["merge","squash"],"nested":{"deep":[1,2,3]},"required_status_checks":[{"context":"a"},{"context":"b"}]}

The reported failure reproduces exactly, and the fix compiles and returns the sorted document. Output is byte-identical to jq 1.7 on the same input, including a deliberately nested array to confirm the local definition still recurses.

Finding a genuine jq 1.5 took three attempts — imega/jq:1.5 does not exist, Debian buster's archives are gone, and Alpine 3.8 ships a master build that already has walk. Ubuntu 18.04 has it. Worth recording, because "I could not reproduce it" would have been the wrong conclusion from the first two.

The choice

walk is defined inside the filter, so the script calls nothing jq 1.5 lacks and keeps one code path across versions.

The alternative in the issue — assert a jq version up front and fail with a message — was considered and declined for the reason the issue itself gives: check is the read-only mode, and refusing to run at all is a worse outcome than running. The issue stated that as a preference rather than a decision, and I agree with it.

Verification

bash -n clean, diff-scoped prose_lint clean, and a live check against this repo still passes on all three parameterized rules of both rulesets.

Downstream

configure.sh is carried verbatim with appliesTo: "*", so this joins the re-vendor the ledger already lists. It is the same file that generated a re-vendor three times today, which is precisely the evidence behind the vendored-tooling entry added in #546.

[Copilot]

Pull request overview

This pull request updates repo-config/configure.sh so its check_ruleset normalization filter no longer depends on jq's walk/1 builtin (introduced in jq 1.6). By defining an equivalent walk-style helper inside the jq program, the ruleset-parameter comparison can run on hosts with jq 1.5 without failing to compile.

Changes:

• Replace the jq walk/1 usage in the norm filter with an in-filter recursive helper (w/1) so jq 1.5 can compile the program.
• Add explanatory comments documenting the jq 1.5 failure mode and why the longer portable filter is justified.