Repository navigation
fix(copyright): SIGPIPE + pipefail race randomly misclassifies files in the header scanner - #94
Merged
Merged
Conversation
…pipefail misclassification Seen live on PR #93's check: 'printf | grep -q' pipes randomly evaluate a MATCH as false - grep -q exits at first hit, printf takes SIGPIPE, and under set -o pipefail the pipeline fails, so an upstream-derived file (ParallelStreamProcessor) was flagged as 'fork-original claims Confluent copyright'. The rename lookup had the worse variant: awk's early exit SIGPIPEs printf inside a $() assignment, which set -e turns into silent script death. All 9 pipe sites converted to herestrings (<<<) - no pipe, no SIGPIPE, correct by construction. Self-test gains a structural guard that fails if a pipe into grep -q / awk ever reappears in the scanner (comment lines excluded). Now doubly important since #92 runs the scanner in mvn validate: the race would have hit every local build, not just CI. Verified: self-tests 17/17, full scan 213 files 0 violations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ALhTf1TRA2S6Ue5rkiQdK
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
✅ Duplicate Code ReportTwo engines run in parallel for cross-validation. Each has its own thresholds tuned to its baseline - the real safety net is the per-engine "max increase vs base" check. ✅ PMD CPD
No new clones introduced by this PR. ✅ jscpd (language-agnostic)
No new clones introduced by this PR. Powered by astubbs/duplicate-code-cross-check |
✅ SpotBugs ReportNo bugs found (new bugs only — baseline from base branch excluded). |
astubbs
added a commit
that referenced
this pull request
Jul 31, 2026
…s race-free here Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ALhTf1TRA2S6Ue5rkiQdK
🧪🔒 Quarantine Lane Report
🔴 expected while the owner PR is open · 🟡🎲 flapper, pass proves nothing · 🚨 a deterministic quarantined test passing means its fix landed: delete its |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Seen live on PR #93's Copyright Headers check: upstream's
ParallelStreamProcessor.javawas flagged as "fork-original file claims Confluent copyright" alongsideprintf: write error: Broken pipe.Root cause: membership tests of the form
printf '%s\n' "$list" | grep -qxF "$f".grep -qexits at the first match; ifprintfis still writing it takes SIGPIPE, and underset -o pipefail(added by the #91 hardening) the pipeline then reports failure even though grep matched - so a file that IS in the upstream list randomly reads as not-found and falls through to the fork-original branch. Timing-dependent, so it passes most runs and fails at random.The rename lookup had a worse variant:
$(printf … | awk '… exit')- awk's earlyexitSIGPIPEs printf inside a command substitution, and underset -ea failed$()assignment kills the whole script silently.Urgency: #92 wired the scanner into
mvn validate, so the race would have intermittently broken every local build, not just the CI check.What
grep -qxF "$f" <<< "$list") - no pipe, no concurrent writer, no SIGPIPE, no race. Same semantics, correct by construction.grep -q/awkagain.Verification
🤖 Generated with Claude Code
https://claude.ai/code/session_013ALhTf1TRA2S6Ue5rkiQdK