Pin the one unpinned shebang script, and gate the pin list both ways

[ptr727]

Found by Copilot review on #68, which flagged that ops/vps-backup-pull is an extensionless shebang script with no LF pin. It is, and the reason it was missed turned out to be the larger half.

The finding

.gitattributes keeps git passive with * -text and then names the files whose line endings are load-bearing. ops/vps-backup-pull carries no extension, so no *.sh or *.py rule reached it. A CRLF checkout hands systemd a broken interpreter line for a script it runs unattended on the backup host.

Why it was invisible

Two pins in that file name files this repository has never carried, in any commit:

Pattern	Tracked files matched
deploy/blog-deploy-shell	0
deploy/authorized_keys	0

Both live on the server, described in OPERATIONS.md "Server Hardening". A pin binds nothing for a file that does not exist, and the comment above those two said "The deploy shell is an extensionless shebang script that matches no rule above." So the file read as though the extensionless case was covered, while the one real instance sat unpinned twenty lines up. Both are dropped, with the reason recorded in place so neither returns as an oversight.

deploy/bootstrap.Caddyfile gets a pin it never had. Caddy reads it from the container's config directory and it is the only Caddy file outside the release bundle, so it is the same daemon-parsed class as deploy/Caddyfile sitting beside it, which was pinned.

The gate

A hand-maintained list that nothing reads back is how both defects got here, so checks/check-eol-pins.py reads it in both directions:

• unpinned — a tracked file opening with #! whose resolved eol is not lf. The shebang is the test rather than the mode bit, because the two move independently and it is the interpreter line that a CRLF breaks.
• dead — a pattern matching no tracked file, which reads as coverage while binding nothing.

It asks git check-attr for the resolved attribute rather than re-implementing the match rules, so it cannot disagree with what git actually applies on checkout, and it fails rather than passing if it finds no shebang files at all. It runs in Lint sources job beside check-env-docs.py.

Verification

Each defect was reintroduced and the gate was watched failing on it, rather than the gate being trusted because it passes:

=== A: drop the ops pin (the reviewer's finding) ===
error: unpinned: ops/vps-backup-pull opens with a shebang and resolves to eol=unspecified.
FAIL - 1 line-ending pin finding(s)

=== B: re-add a never-tracked pin ===
error: dead: .gitattributes:60 pattern 'deploy/blog-deploy-shell' matches no tracked file.
FAIL - 1 line-ending pin finding(s)

=== restored, control ===
PASS - 16 shebang files pinned to LF, 12 patterns all matching tracked files

It also caught its own file before that was staged, which is the third direction working.

git add --renormalize . after the change stages nothing beyond the three files here, so the pins bind future checkouts and rewrite no bytes now.

The systemd units are deliberately not pinned, measured rather than assumed. systemd-analyze verify on a CRLF copy of vps-backup-pull.service reports the same clean result as the LF original, and the same tool does flag an unreachable ExecStart, so the negative means something. They are not in this class.

ops/install.sh needed nothing: *.sh already covers it.

[Copilot]

Pull request overview

This pull request strengthens the repository’s line-ending enforcement by pinning an extensionless shebang script to LF in .gitattributes and introducing a CI gate that checks .gitattributes coverage in both directions (shebang files must resolve to eol=lf, and .gitattributes patterns must match at least one tracked file).

Changes:

• Add checks/check-eol-pins.py to detect (1) unpinned tracked shebang files and (2) “dead” .gitattributes patterns that match no tracked files.
• Run the new check in .github/workflows/validate-task.yml alongside existing source validation.
• Update .gitattributes to pin ops/vps-backup-pull (and checks/check-eol-pins.py) to LF, remove never-tracked pins, and add an LF pin for deploy/bootstrap.Caddyfile.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
checks/check-eol-pins.py	Adds a new validation gate that checks shebang LF pinning and detects dead .gitattributes patterns via git-resolved attributes.
.github/workflows/validate-task.yml	Runs the new line-ending pin gate in CI during the validation workflow.
.gitattributes	Pins the extensionless shebang script to LF, pins the new checker script, removes dead pins, and pins deploy/bootstrap.Caddyfile.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.