Label Audit Commands as Bash

[ptr727]

Summary

• Label all Bash-dependent audit command blocks as bash.
• Add regression coverage that rejects a POSIX sh label on these blocks.

Root Cause

The audit commands use process substitution, here-strings, and ANSI-C quoting, but their fence labels implied generic POSIX shell compatibility.

Validation

• 729 Python tests
• audit self-tests and spec validation
• ruff, mypy, and coverage
• actionlint, markdownlint, EditorConfig, CSpell, ShellCheck, and PSScriptAnalyzer

Follow-up to the suppressed Copilot finding on #846.

[Copilot]

Pull request overview

This PR updates the audit documentation to correctly label Bash-specific command blocks as bash, and adds a regression test to prevent reintroducing POSIX sh code fences in AUDIT.md.

Changes:

• Relabel selected AUDIT.md fenced command blocks from sh to bash.
• Add a unit test that fails if AUDIT.md contains a POSIX sh fence label.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
AUDIT.md	Relabel audit command fences to bash for Bash-only syntax.
scripts/tests/test_release_guards.py	Add regression coverage preventing AUDIT.md from using ```sh fences.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

scripts/tests/test_release_guards.py:66

• The regression test will fail with an unhelpful message because it only reports the repeated string "sh" and not where it occurs in AUDIT.md. Recording line numbers (and catching "sh" with trailing info) makes the failure actionable.

 def test_audit_bash_blocks_are_not_labeled_as_posix_shell(self) -> None:
audit_lines = (REPO / "AUDIT.md").read_text(encoding="utf-8").splitlines()
mislabeled = [line for line in audit_lines if line.strip() == "```sh"]
self.assertEqual([], mislabeled)

[ptr727]

Suppressed comments (1)

scripts/tests/test_release_guards.py:66

The regression test will fail with an unhelpful message because it only reports the repeated string "sh" and not where it occurs in AUDIT.md. Recording line numbers (and catching "sh" with trailing info) makes the failure actionable.

Fixed in d31bd90. The regression test now reports each matching line number and text, and catches both an exact sh fence label and one followed by additional info.

Review round: #848 (review)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

scripts/tests/test_release_guards.py:70

• The new regression test is both over-broad and under-specific: it forbids anysh fence anywhere in AUDIT.md (which would block legitimate POSIX sh examples), and it still wouldn't catch a regression where a Bash-only block is mislabeled as shell. Consider asserting that any code fence containing Bash-only constructs (e.g., process substitution <(, here-strings <<<, ANSI-C quoting $'...') is labeled ```bash instead.

 def test_audit_bash_blocks_are_not_labeled_as_posix_shell(self) -> None:
audit_lines = (REPO / "AUDIT.md").read_text(encoding="utf-8").splitlines()
mislabeled = [
(number, line)
for number, line in enumerate(audit_lines, start=1)

[ptr727]

Suppressed comments (1)

scripts/tests/test_release_guards.py:70

The new regression test is both over-broad and under-specific: it forbids any sh fence anywhere in AUDIT.md (which would block legitimate POSIX sh examples), and it still would not catch a regression where a Bash-only block is mislabeled as shell. Consider asserting that any code fence containing Bash-only constructs is labeled bash instead.

Fixed in 6f72b23da7daa0534196d721dc064e23e975d5a8. The test now parses fenced blocks, permits ordinary POSIX examples, and reports sh or shell fence labels only when their body contains Bash-only syntax. Its diagnostic includes the opening fence line.

Review round: #848 (review)

[ptr727]

Correction: the fixing commit in the preceding response is 6f72b23. The abbreviated 6f72b23 was correct; the manually expanded suffix was not.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.