test(repo-hygiene): pin batch_read_lines_into under ulimit -n 10

[kyle-sexton]

No linked issue

Summary

#3641 switched batch_read_lines_into from exec {fd}< to fixed exec 3< so a ulimit -n 10 runner can still open a named source. The test matrix never exercised that limit.

Fix

Add a guarded case in batch-common.test.sh that lowers ulimit -n to 10 and reads a one-line list. Skip if the host refuses the ulimit. repo-hygiene 0.10.23 (avoids in-flight 0.10.21 / 0.10.22).

Verification

bash plugins/repo-hygiene/skills/clean/scripts/lib/batch-common.test.sh: cases 28-29 pass (named source opens under ulimit -n 10, low-fd read yields the line). scripts/affected-tests.sh --run: 1 suite passed.

Related

Refs #3641 (Codex review on the merged PR).

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T09:00:19.855705Z	11ca26d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 56s —— View job

---

Security review: no issues found

• Gather context (PR diff, changed files)
• Apply skip gate (/review:security-review)
• Review security-relevant surface of the diff
• Post findings / conclusion

Skip gate hit: this PR has no security-relevant surface. The diff (git diff origin/main...HEAD) touches only:

• plugins/repo-hygiene/.claude-plugin/plugin.json — version bump (0.10.20 → 0.10.23)
• plugins/repo-hygiene/CHANGELOG.md — changelog entry
• plugins/repo-hygiene/skills/clean/scripts/lib/batch-common.test.sh — a new guarded test case that lowers ulimit -n to 10 and verifies batch_read_lines_into still reads a named source on fixed fd 3

The added test shell invokes bash -c '...' with a fixed script body and passes the script path / file path as positional parameters ("$1", "$2"), properly quoted — no user-controlled input reaches command construction, and it only reads a file this same test creates in $TEST_TMPDIR. No production code changes; batch_read_lines_into itself isn't modified by this PR (that landed in #3641). No injection, privilege, or trust-boundary surface here.

No security issues found.

[github-actions]

Last security-reviewed head: 11ca26d9fd49ededd8dd04b59ce2db652c31c957. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @kyle-sexton's task in 21s —— View job

---

Code review skipped

Invoked /review:code-review per instructions. This PR's state is MERGED (per the provided PR context), which matches the skill's skip gate condition 1 ("PR is closed or not open"). Per that gate, the review stops early and no findings are posted.

• Gather context
• Determine skip gate applies (PR is merged, not open)
• Report result

No inline comments were posted since the review did not proceed past the skip gate.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.