You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Finding: Correct removal of a non-standard property.
switch_case_indent is not part of the EditorConfig specification. It is a vendor-specific extension recognized only by certain JetBrains IDEs for shell indentation of case bodies. Standard EditorConfig parsers and most editors silently ignore unknown properties, so this property had limited practical effect and its removal is appropriate.
No issues found.
Check
Result
EditorConfig spec compliance
✅ Removes non-standard property
Security
✅ No concerns
Managed-file protocol
✅ Change originates in upstream standards repo — correct workflow
CLAUDE.md SHA-pin / security rules
✅ Not applicable to this change
The Cursor approval is consistent with this assessment. This PR is safe to merge.
The standards-synced .editorconfig no longer sets switch_case_indent for
shell files, so shfmt's default (non-indented case branches) now governs.
Reformat the two osv-scan-guard scripts to match; whitespace-only, no
behavior change. Removes the local drift that previously required the
switch_case_indent override.
This PR now contains three files changed across two commits:
A standards-sync commit updating .editorconfig
A follow-on style commit reformatting osv-scan-guard.sh and osv-scan-guard.test.sh to shfmt defaults
.editorconfig (+8/-2)
Two substantive changes:
Go section added (lines 41–43): Sets indent_style = unset / indent_size = unset, deferring indentation to gofmt. This mirrors the existing JS/TS deferral to Biome — correct pattern and well-commented.
switch_case_indent = true removed (shell section): This is a JetBrains-only EditorConfig extension, not part of the spec. Its removal is correct. Importantly, this removal is what enables the follow-on shfmt reformatting below.
osv-scan-guard.sh (+49/-49)
Pure indentation reformatting — exactly +49/-49 with zero logic changes. The outer case "$policy_phase" in labels (scan, sarif, *) move from 2-space-indented to flush-with-case-keyword, which is shfmt's default style. The inner case "$scan_exit" in block follows the same pattern. Verified by reading the full file: all logic paths, conditions, and ;; terminators are unchanged.
This is directly consistent with the EditorConfig change: the old switch_case_indent = true was pushing JetBrains IDEs toward the indented-label style; removing it lets shfmt be the single formatting authority.
osv-scan-guard.test.sh (+17/-17)
Same shfmt reformatting applied to the two case blocks in the test harness. Logic unchanged.
Findings
No issues found.
Check
Result
Logic correctness
✅ Zero logic changes; diff is purely whitespace
EditorConfig compliance
✅ Go section correct; non-standard property correctly removed
shfmt consistency
✅ EditorConfig and code reformatting are complementary
Security
✅ No concerns
CLAUDE.md SHA-pin / security rules
✅ Not applicable (no uses: references changed)
.github/workflows/ restriction
✅ Scripts are under .github/scripts/, not .github/workflows/
The two Cursor approvals and prior review are consistent with this assessment. Safe to merge.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: low. Not approving — selector-contract failed because osv-scan-guard.sh changes left osv-scanner.yml out of sync (run render-osv-scan-guard.cjs). Cursor Bugbot was not present. Reviewer kyle-sexton assigned.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The scan-exit guard reindent in the prior commit desynced the generated
copy embedded in osv-scanner.yml from its source (osv-scan-guard.sh),
failing the render --check contract test. Regenerate the embedded SCAN
and SARIF blocks via render-osv-scan-guard.cjs. No behavior change.
This PR now has three commits. The third commit (3dbfd19) directly addresses the selector-contract failure Cursor flagged: it regenerates the embedded guard in osv-scanner.yml to match the reformatted source script. All four changed files are clean.
.editorconfig (+8/-2)
Two changes:
Go section added (lines 38–42): Sets indent_style = unset / indent_size = unset, deferring to gofmt. Mirrors the existing JS/TS deferral pattern and is correctly documented.
switch_case_indent = true removed from [*.{sh,bash}]: Non-standard JetBrains extension, not part of the EditorConfig spec. Correct removal; enables shfmt as the sole formatting authority.
osv-scan-guard.sh (+49/-49)
Pure shfmt-style reformatting — outer case "$policy_phase" in and nested case "$scan_exit" in labels move from 2-space-indented to flush-with-case-keyword. Zero logic changes.
osv-scan-guard.test.sh (+17/-17)
Same reformatting on the two case blocks in the test harness. Zero logic changes.
osv-scanner.yml (+98/-98)
The render-osv-scan-guard.cjs script embeds the guard source with a fixed 10-space base indent. I verified both generated blocks:
SCAN guard (lines 168–279): case labels are scan) / sarif) (10 spaces = base only, matching flush-label source). Nested case "$scan_exit" labels are 0 | 1) (12 spaces = base + 2 indent). ✅ Correct.
SARIF guard (lines 316–427): Identical structure and indentation. ✅ Correct.
The --check mode of render-osv-scan-guard.cjs would pass on this state — the selector-contract failure from the previous push is resolved.
Findings
No issues found.
Check
Result
Logic correctness
✅ Zero logic changes across all files; diff is purely formatting
The reason will be displayed to describe this comment to others. Learn more.
Risk: low. Approving — selector-contract and CI checks pass; Cursor Bugbot was not present on this PR. Reviewer kyle-sexton remains assigned from the prior run.
Sent by Cursor Approval Agent: Pull Request Router and Approver
## Summary
#89 updated the immutable-pin fetch step in `ci.yml` but missed the
identical step in `selector-conformance.yml`. On main-push runs the
squashed PR branch commits are unreachable from a plain full-history
checkout, so `git show 169e3a4` inside the pin tests fails — the
post-merge `selector-conformance` run on main is red. PR runs passed
because the PR merge ref still reached those commits, which hid the gap.
One-line fix: fetch `169e3a4287211a536eddcd3a757dd06132fb556e` (the
liveness canary/HA-proof implementation commit) instead of the two
superseded pins.
Part of melodic-software/github-iac#79, epic #78.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01EPDbXgonTuFwFwdTtHaCmw
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> CI workflow-only change to which git objects are fetched; no runtime,
auth, or application logic.
>
> **Overview**
> Aligns **`selector-conformance.yml`** with **`ci.yml`** by updating
the **Fetch immutable workflow pins under test** step to shallow-fetch a
single commit (`169e3a4…`) instead of two superseded SHAs.
>
> That commit is the current liveness canary / HA-proof implementation
pin exercised by the immutable-pin tests. After squashed merges, those
old commits are not reachable from a full-history checkout on **main**,
so `git show` in the tests failed on post-merge runs even though PR runs
still passed.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
061172d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…repository (#96)
## Why
Production deploys on melodic-software/github-iac fail closed at the
deploy guard: `Pulumi personal-token allow policies do not exactly match
the reviewed contract` (first failure: run 29372145481). Root cause:
Epic #78 C4 deleted `kyle-sexton/github-iac` and reduced live Pulumi
OIDC trust to exactly the one organization rule, while the bundled
contract still required the deleted repo's policy. Exact-match guard =
correct fail-closed behavior; the reviewed contract is what must move.
## What
- `contracts/kyle-sexton-github-iac.json`: the single surviving
`melodic-software/github-iac` policy (byte-identical rules to the prior
org entry); replaces `kyle-sexton-github-iac-v2.json` — version markers
dropped from the contract name, since the contract is a living
exact-match document whose identity is the stack it guards
- `guard.test.sh` + `pulumi-deploy-guard.test.cjs`: repointed to the
unversioned contract; content test asserts the single-policy shape
## Verification
- `guard.test.sh`: 22/22 PASS
- `node --test pulumi-deploy-guard.test.cjs`: 5 pass / 0 fail
## Follow-up
melodic-software/github-iac PR bumps its pinned guard SHA +
`policy-contract: kyle-sexton-github-iac`, unblocking the
dotfiles-enrollment deploy (#109 merged but unapplied).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01JLfjHY8PY6ozhgZPiuHKik
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
standards-syncStandards-config sync PRs from the standards-sync workflow.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
melodic-standards-sync
Bot
added
the
standards-sync
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Automated exact-file synchronization from
melodic-software/standards@4f65231cb0e77717ae6179375eebfc250ddde7bb(requested refmain).Managed component mappings applied to
melodic-software/ci-workflows:components/comment-hygiene/comment-hygiene-patterns.sh→.github/actions/comment-hygiene/comment-hygiene-patterns.sh(mode100644).editorconfig-checker.json→.editorconfig-checker.json(mode100644).gitleaks.toml→.gitleaks.toml(mode100644)lychee.toml→lychee.toml(mode100644).markdownlint-cli2.jsonc→.markdownlint-cli2.jsonc(mode100644)PSScriptAnalyzerSettings.psd1→PSScriptAnalyzerSettings.psd1(mode100644).editorconfig→.editorconfig(mode100644).gitattributes→.gitattributes(mode100644).shellcheckrc→.shellcheckrc(mode100644)_typos.toml→_typos.toml(mode100644)Review and merge this PR normally. Do not hand-edit these managed files downstream; change their standards source instead.