fix(ci): enforce invisible-character findings

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -121,12 +121,20 @@ jobs:
 
           root = Path(os.environ["GITHUB_WORKSPACE"])
           skipped_dirs = {
-              ".git", ".deno", ".lake", "_build", "deps",
-              "external_corpora", "node_modules", "target",
+              ".cache", ".deno", ".elixir_ls", ".git", ".lake", ".zig-cache",
+              "_build", "build", "coverage", "deps", "dist", "external_corpora",
+              "node_modules", "out", "target", "vendor", "zig-cache", "zig-out",
+          }
+          intentional_fixture_dirs = {
+              ("tests", "fixtures", "bom-detection"),
+              ("tests", "fixtures", "empty-linter"),
           }
           source_suffixes = {
-              ".adoc", ".ex", ".exs", ".gleam", ".hs", ".idr", ".jl",
-              ".js", ".json", ".md", ".ml", ".res", ".rs", ".sh",
+              ".adoc", ".adb", ".ads", ".agda", ".c", ".cc", ".clj", ".cljs",
+              ".cpp", ".erl", ".ex", ".exs", ".fs", ".fsi", ".fsx", ".gleam",
+              ".h", ".hh", ".hpp", ".hrl", ".hs", ".idr", ".java", ".jl",
+              ".js", ".json", ".kt", ".kts", ".lean", ".lua", ".md", ".ml",
+              ".php", ".r", ".rb", ".res", ".rs", ".scala", ".sh", ".swift",
               ".toml", ".ts", ".v", ".yaml", ".yml", ".zig",
           }
           invisible_codepoints = {
@@ -136,50 +144,62 @@ jobs:
               *range(0x2066, 0x206A),
           }
 
-          def annotation_escape(value):
+          def command_escape(value):
               return str(value).replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
 
+          def property_escape(value):
+              return command_escape(value).replace(":", "%3A").replace(",", "%2C")
+
+          # Runtime regression for GitHub workflow-command property delimiters.
+          assert property_escape("docs/a,b::c.md") == "docs/a%2Cb%3A%3Ac.md"
+
+          def intentionally_invalid_fixture(relative):
+              return any(relative.parts[:len(prefix)] == prefix for prefix in intentional_fixture_dirs)
+
           findings = []
           errors = []
-          for path in root.rglob("*"):
-              relative = path.relative_to(root)
-              if (
-                  path.is_symlink()
-                  or not path.is_file()
-                  or path.suffix.lower() not in source_suffixes
-                  or any(part in skipped_dirs for part in relative.parts[:-1])
-              ):
-                  continue
-              try:
-                  data = path.read_bytes()
-              except OSError as error:
-                  errors.append((relative, f"could not read file: {error}"))
-                  continue
+          for directory, dirnames, filenames in os.walk(root, topdown=True):
+              dirnames[:] = [name for name in dirnames if name not in skipped_dirs]
+              directory_path = Path(directory)
+              for filename in filenames:
+                  path = directory_path / filename
+                  relative = path.relative_to(root)
+                  if (
+                      path.is_symlink()
+                      or path.suffix.lower() not in source_suffixes
+                      or intentionally_invalid_fixture(relative)
+                  ):
+                      continue
+                  try:
+                      data = path.read_bytes()
+                  except OSError as error:
+                      errors.append((relative, f"could not read file: {error}"))
+                      continue
 
-              reasons = set()
-              if data.startswith(b"\xef\xbb\xbf"):
-                  reasons.add("leading UTF-8 BOM")
-              if any(byte <= 0x08 or byte in (0x0B, 0x0C) or 0x0E <= byte <= 0x1F for byte in data):
-                  reasons.add("C0 control character")
-              try:
-                  text_content = data.decode("utf-8", errors="strict")
-              except UnicodeDecodeError as error:
-                  errors.append((relative, f"invalid UTF-8 at byte {error.start}"))
-                  continue
-              if any(ord(character) in invisible_codepoints for character in text_content):
-                  reasons.add("invisible Unicode code point")
-              if reasons:
-                  findings.append((relative, ", ".join(sorted(reasons))))
+                  reasons = set()
+                  if data.startswith(b"\xef\xbb\xbf"):
+                      reasons.add("leading UTF-8 BOM")
+                  if any(byte <= 0x08 or byte in (0x0B, 0x0C) or 0x0E <= byte <= 0x1F for byte in data):
+                      reasons.add("C0 control character")
+                  try:
+                      text_content = data.decode("utf-8", errors="strict")
+                  except UnicodeDecodeError as error:
+                      errors.append((relative, f"invalid UTF-8 at byte {error.start}"))
+                      continue
+                  if any(ord(character) in invisible_codepoints for character in text_content):
+                      reasons.add("invisible Unicode code point")
+                  if reasons:
+                      findings.append((relative, ", ".join(sorted(reasons))))
 
           with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
               output.write(f"findings={len(findings)}\n")
               output.write(f"exit_code={2 if errors else 0}\n")
               output.write("ready=true\n")
 
           for relative, reasons in findings:
-              print(f"::warning file={annotation_escape(relative)}::Invisible characters detected: {reasons}")
+              print(f"::warning file={property_escape(relative)}::Invisible characters detected: {command_escape(reasons)}")
           for relative, reason in errors:
-              print(f"::error file={annotation_escape(relative)}::Invisible-character scan failed: {annotation_escape(reason)}")
+              print(f"::error file={property_escape(relative)}::Invisible-character scan failed: {command_escape(reason)}")
           PY
       - name: Write summary
         run: |
@@ -196,6 +216,7 @@ jobs:
               echo "## Empty-Linter Results" >> "$GITHUB_STEP_SUMMARY"
               echo "" >> "$GITHUB_STEP_SUMMARY"
               echo "Found **${FINDINGS}** invisible character issue(s). See annotations above." >> "$GITHUB_STEP_SUMMARY"
+              exit 1
             else
               echo "## Empty-Linter Results" >> "$GITHUB_STEP_SUMMARY"
               echo "" >> "$GITHUB_STEP_SUMMARY"