fix(ci): make invisible scan byte-safe

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -115,37 +115,83 @@ jobs:
           # Inline invisible character detection (from empty-linter's core patterns).
           # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,
           # non-breaking spaces, null bytes, and other invisible Unicode in source files.
-          set +e
-          PATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]'
-          find "$GITHUB_WORKSPACE" \
-            -not -path '*/.git/*' -not -path '*/node_modules/*' \
-            -not -path '*/.deno/*' -not -path '*/target/*' \
-            -not -path '*/_build/*' -not -path '*/deps/*' \
-            -not -path '*/external_corpora/*' -not -path '*/.lake/*' \
-            -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \
-              -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \
-              -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \
-              -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \
-              -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \
-            -exec grep -aPl "$PATTERNS" {} + > /tmp/empty-lint-results.txt 2>/dev/null
-          EL_EXIT=$?
-          set -e
+          python3 - <<'PY'
+          import os
+          from pathlib import Path
 
-          FINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0)
-          echo "findings=$FINDINGS" >> "$GITHUB_OUTPUT"
-          echo "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"
-          echo "ready=true" >> "$GITHUB_OUTPUT"
+          root = Path(os.environ["GITHUB_WORKSPACE"])
+          skipped_dirs = {
+              ".git", ".deno", ".lake", "_build", "deps",
+              "external_corpora", "node_modules", "target",
+          }
+          source_suffixes = {
+              ".adoc", ".ex", ".exs", ".gleam", ".hs", ".idr", ".jl",
+              ".js", ".json", ".md", ".ml", ".res", ".rs", ".sh",
+              ".toml", ".ts", ".v", ".yaml", ".yml", ".zig",
+          }
+          invisible_codepoints = {
+              0x00A0, 0x00AD, 0x2060, 0xFEFF,
+              *range(0x200B, 0x2010),
+              *range(0x202A, 0x2030),
+              *range(0x2066, 0x206A),
+          }
 
-          # Emit annotations for each file with invisible chars
-          while IFS= read -r filepath; do
-            [ -z "$filepath" ] && continue
-            REL_PATH="${filepath#$GITHUB_WORKSPACE/}"
-            echo "::warning file=${REL_PATH}::Invisible Unicode characters detected (zero-width space, BOM, NBSP, etc.)"
-          done < /tmp/empty-lint-results.txt
+          def annotation_escape(value):
+              return str(value).replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
+
+          findings = []
+          errors = []
+          for path in root.rglob("*"):
+              relative = path.relative_to(root)
+              if (
+                  path.is_symlink()
+                  or not path.is_file()
+                  or path.suffix.lower() not in source_suffixes
+                  or any(part in skipped_dirs for part in relative.parts[:-1])
+              ):
+                  continue
+              try:
+                  data = path.read_bytes()
+              except OSError as error:
+                  errors.append((relative, f"could not read file: {error}"))
+                  continue
+
+              reasons = set()
+              if data.startswith(b"\xef\xbb\xbf"):
+                  reasons.add("leading UTF-8 BOM")
+              if any(byte <= 0x08 or byte in (0x0B, 0x0C) or 0x0E <= byte <= 0x1F for byte in data):
+                  reasons.add("C0 control character")
+              try:
+                  text_content = data.decode("utf-8", errors="strict")
+              except UnicodeDecodeError as error:
+                  errors.append((relative, f"invalid UTF-8 at byte {error.start}"))
+                  continue
+              if any(ord(character) in invisible_codepoints for character in text_content):
+                  reasons.add("invisible Unicode code point")
+              if reasons:
+                  findings.append((relative, ", ".join(sorted(reasons))))
+
+          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+              output.write(f"findings={len(findings)}\n")
+              output.write(f"exit_code={2 if errors else 0}\n")
+              output.write("ready=true\n")
+
+          for relative, reasons in findings:
+              print(f"::warning file={annotation_escape(relative)}::Invisible characters detected: {reasons}")
+          for relative, reason in errors:
+              print(f"::error file={annotation_escape(relative)}::Invisible-character scan failed: {annotation_escape(reason)}")
+          PY
       - name: Write summary
         run: |
           if [ "${{ steps.lint.outputs.ready }}" = "true" ]; then
             FINDINGS="${{ steps.lint.outputs.findings }}"
+            EXIT_CODE="${{ steps.lint.outputs.exit_code }}"
+            if [ "$EXIT_CODE" -ne 0 ] 2>/dev/null; then
+              echo "## Empty-Linter Results" >> "$GITHUB_STEP_SUMMARY"
+              echo "" >> "$GITHUB_STEP_SUMMARY"
+              echo ":x: Scanner execution failed; see error annotations above." >> "$GITHUB_STEP_SUMMARY"
+              exit 1
+            fi
             if [ "$FINDINGS" -gt 0 ] 2>/dev/null; then
               echo "## Empty-Linter Results" >> "$GITHUB_STEP_SUMMARY"
               echo "" >> "$GITHUB_STEP_SUMMARY"