From 7662f965c3e6ef79f43da3ec97ad687d92d1a9cc Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:02:34 +0000
Subject: [PATCH] refactor(ci): satisfy the shell analysis the way SonarCloud
 asks, not around it

SonarCloud flagged the helper on two counts, both fair for a bash script
that is sourced into a bash workflow step:

- `[` over `[[`. The script runs under bash (`#!/usr/bin/env bash`, and
  the workflow sources it into a bash step), so `[[` is strictly the
  better construct: no word splitting, no pathname expansion, and a
  `-eq` that cannot be talked into a string comparison.
- Diagnostics on stdout. The `::error::` annotations now go to stderr.
  GitHub Actions reads workflow commands from either stream, so the
  annotations are unchanged; what changes is that a failure message no
  longer lands in a caller's captured stdout.

Behaviour is unchanged and re-verified against the same real failure
modes after the edit: a good download with the matching checksum passes,
an empty body is refused with its message on stderr, an HTTP 404 still
fails, and the pin test that guards the wiring still passes 123/123.
---
 scripts/ci/fetch_pinned.sh | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/scripts/ci/fetch_pinned.sh b/scripts/ci/fetch_pinned.sh
index fb94994..4da87bb 100644
--- a/scripts/ci/fetch_pinned.sh
+++ b/scripts/ci/fetch_pinned.sh
@@ -62,14 +62,14 @@ fetch_pinned() {
          --connect-timeout 20 --max-time 600 \
          -o "$out" "$url" || rc=$?
 
-    if [ "$rc" -eq 0 ]; then
+    if [[ "$rc" -eq 0 ]]; then
         # A 200 with an empty body is a success to curl and a broken artifact to
         # everyone else. The checksum check would catch it, but naming it here says
         # which of the two happened.
-        if [ -s "$out" ]; then
+        if [[ -s "$out" ]]; then
             return 0
         fi
-        echo "::error::fetched $url but it is empty; the checksum check would fail next"
+        echo >&2 "::error::fetched $url but it is empty; the checksum check would fail next"
         return 1
     fi
 
@@ -84,27 +84,27 @@ fetch_pinned() {
 
     case "$rc" in
         35|51|58|60|77|83|90)
-            echo "::error::TLS verification failed (curl exit $rc) fetching $url"
-            echo "::error::The certificate is the problem, not this commit. Confirm with:"
-            echo "::error::  openssl s_client -connect $host:443 </dev/null 2>/dev/null | openssl x509 -noout -dates -subject"
-            echo "::error::If it has expired, the host has to renew it: re-run then, or repoint"
-            echo "::error::the URL and sha256 in config/defaults/tool_versions.yml if the"
-            echo "::error::artifact has moved. Do NOT skip the tool — CI installs it because"
-            echo "::error::the pipeline shells out to it (issue #30)."
+            echo >&2 "::error::TLS verification failed (curl exit $rc) fetching $url"
+            echo >&2 "::error::The certificate is the problem, not this commit. Confirm with:"
+            echo >&2 "::error::  openssl s_client -connect $host:443 </dev/null 2>/dev/null | openssl x509 -noout -dates -subject"
+            echo >&2 "::error::If it has expired, the host has to renew it: re-run then, or repoint"
+            echo >&2 "::error::the URL and sha256 in config/defaults/tool_versions.yml if the"
+            echo >&2 "::error::artifact has moved. Do NOT skip the tool — CI installs it because"
+            echo >&2 "::error::the pipeline shells out to it (issue #30)."
             ;;
         22)
-            echo "::error::the server answered with an HTTP error status fetching $url"
-            echo "::error::(curl --fail, exit 22). The pinned URL is wrong or the artifact"
-            echo "::error::was withdrawn; check config/defaults/tool_versions.yml against"
-            echo "::error::whatever the project is serving now."
+            echo >&2 "::error::the server answered with an HTTP error status fetching $url"
+            echo >&2 "::error::(curl --fail, exit 22). The pinned URL is wrong or the artifact"
+            echo >&2 "::error::was withdrawn; check config/defaults/tool_versions.yml against"
+            echo >&2 "::error::whatever the project is serving now."
             ;;
         6|7|28|56)
-            echo "::error::network failure (curl exit $rc) fetching $url after 4 retries;"
-            echo "::error::host unreachable or slow rather than refusing TLS. Re-run, or check"
-            echo "::error::the host is still the right place for this pin."
+            echo >&2 "::error::network failure (curl exit $rc) fetching $url after 4 retries;"
+            echo >&2 "::error::host unreachable or slow rather than refusing TLS. Re-run, or check"
+            echo >&2 "::error::the host is still the right place for this pin."
             ;;
         *)
-            echo "::error::download failed (curl exit $rc) fetching $url"
+            echo >&2 "::error::download failed (curl exit $rc) fetching $url"
             ;;
     esac
     return "$rc"