fix(gates): composite shell -e silently killed two gates

[hyperpolymath]

The defect

GitHub runs every composite shell: bash step as:

bash --noprofile --norc -e -o pipefail {0}

That -e comes from the harness, not from the script, and a script's own
set -uo pipefail does not clear it — it never mentions e. So any
x=$(grep ... ) is a silent kill site whenever grep legitimately matches nothing.

Two gates were dying on it, each in the exact case it exists to handle.

1. required-files-check — killed the repos it was written to accept

functional_lines=$(grep -vE '^\s*(#|//|;|$)' "$f" | wc -l)
if [ "$functional_lines" -eq 0 ]; then
  echo "  CODEOWNERS is comment-only (valid for solo-maintained repos per Rule 1)"

A comment-only CODEOWNERS makes grep -v exit 1 → pipefail → -e kills the
step one line above the message declaring that file valid.

Measured on pons-asinorum run 35782895038. The failure is invisible twice
over: no ::error:: is ever reached, so the log simply stops after the last
successful echo, and the check-run annotation carries only
Process completed with exit code 1.

Because this is step 3 of the estate audit, its red skips 25 downstream
gates. One unguarded pipeline has been blanking the entire audit for every
solo-maintained repo in the estate.

2. spdx-license-check — its own warning branch was unreachable

has_spdx=$(git grep -i "SPDX-License-Identifier" | wc -l)
if [ "$has_spdx" -eq 0 ]; then
   echo "::warning::No SPDX-License-Identifier lines found in the repository."
   # exit 1 (disabled strictly to prevent total CI blockage until adoption)

git grep exits 1 on zero matches, so a repo with no SPDX headers — the only
case this check exists to detect — hard-failed the step, doing the exact
opposite of what the comment beside it says.

The fix

• required-files-check: set +e, restoring the script's own contract. It
  accumulates fail=1 so it can report every defect and exit once at the end;
  -e means "die on the first", which is the opposite contract. Both count sites
  are additionally guarded with || true, so the intent survives someone
  re-adding -e later.
• spdx-license-check: guard the git grep so the zero-SPDX branch is
  reachable at all.
• Swept every composite for the same shape. formatting-check and
  metrics-check already used || true / || echo 0 at every such site — the
  authors knew about this hazard and missed these two files. No other instances.

Non-vacuity

tests/composite-shell-contract.sh runs both gates under the exact CI shell
against a fixture repo that is valid under every rule those gates state
(comment-only CODEOWNERS, zero SPDX headers), and kills a mutant:

• reinstates the unguarded pipeline and removes set +e;
• asserts both mutations actually applied — $RF is yq-extracted, so its
  indentation is not the .yml's, and a no-op sed here produces a fake green
  (this happened while writing the file);
• asserts the mutant parses — a mutant that fails bash -n produces a fake red;
• requires the mutant to die silently, with no ::error:: — the CI signature.
  Without that last check the red could come from fixture drift and would prove
  nothing about -e (this also happened while writing the file: a 4-line
  MAINTAINERS stub made the mutant "die" for the wrong reason).

PASS=7 FAIL=0
  ok   mutant dies SILENTLY (rc=1), no ::error:: — the -e kill is reproduced

Wired into code-hygiene-self-test.yml with the matching paths: filters.

Verification

Reproduced locally against pons-asinorum at the same composite version CI ran
(@main = 6ff6057):

shell	result
bash reqfiles.sh	rc=0 — this is what made the bug invisible
bash -e -o pipefail reqfiles.sh	rc=1, silent, identical to CI
after this patch, -e -o pipefail	rc=0, prints the Rule 1 acceptance and the success line

Refs: #787

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

[coderabbitai]

Warning

Review limit reached

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d1eb2b31-f3a0-4e7b-a004-157daaabc5cd

📥 Commits

Reviewing files that changed from the base of the PR and between 6ff6057 and 6614b5f.

📒 Files selected for processing (4)

• .github/workflows/code-hygiene-self-test.yml
• actions/required-files-check/action.yml
• actions/spdx-license-check/action.yml
• tests/composite-shell-contract.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
12 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud