fix(scripts): backticks in a double-quoted echo run as command substitution

[hyperpolymath]

Line 19 wrapped an example in backticks inside a double-quoted string. Backticks there are COMMAND SUBSTITUTION, so bash tried to execute '+ uses: …@' and printed the message with the example silently deleted. Switched to single quotes. Same defect class as hyperpolymath/Axiom.jl#82.

Found by an estate-wide shellcheck sweep of 5,111 tracked scripts across 375 repos. This file was one of 11 that fail to parse (SC1073/SC1072) — shellcheck stops analysing at the failure, so everything after it was never checked either.

Verified: shellcheck -S error now reports 0 findings for this file.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8f3a47ea-d4c5-47ba-ae9d-609ceb0cab97

📥 Commits

Reviewing files that changed from the base of the PR and between 90e2512 and c3314c0.

📒 Files selected for processing (1)

• bots/seambot/tests/github_integration.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (7)

• GitHub Check: CodeQL
• GitHub Check: governance / Validate Hypatia Baseline
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: build · test · clippy (robot-repo-automaton)
• GitHub Check: build · test · clippy (shared-context)
• GitHub Check: analyze (actions, none)
• GitHub Check: build · test · clippy (dashboard)

⚠️ CI failures not shown inline (4)

GitHub Actions: Dogfood Gate / 1_Groove manifest check.txt: fix(scripts): backticks in a double-quoted echo run as command substitution

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

---

GitHub Actions: Dogfood Gate / Groove manifest check: fix(scripts): backticks in a double-quoted echo run as command substitution

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

---

GitHub Actions: Dogfood Gate / 4_Validate A2ML manifests.txt: fix(scripts): backticks in a double-quoted echo run as command substitution

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `hyperpolymath/a2ml-ecosystem`: the repository has been renamed or transferred. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

---

GitHub Actions: Dogfood Gate / Validate A2ML manifests: fix(scripts): backticks in a double-quoted echo run as command substitution

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `hyperpolymath/a2ml-ecosystem`: the repository has been renamed or transferred. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

🔇 Additional comments (1)

bots/seambot/tests/github_integration.rs (1)

154-154: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Improved informational messages for pull requests without SHA-pinned action additions, ensuring backticks are displayed literally and no unintended command substitution occurs.
• Tests
  • Updated installation-token test coverage with a shorter representative token while preserving validation of the expected format and parsing behaviour.

Walkthrough

The obsolete pull request script now preserves literal backticks in its skip message. The GitHub integration test now uses a shorter concrete installation token fixture. No control flow or public declarations changed.

Changes

Maintenance updates

Layer / File(s)	Summary
Skip message quoting scripts/fix-close-obsolete-pr.sh	The no-pinned-uses: skip message now emits literal backticks. Bash no longer attempts command substitution.
Installation token fixture bots/seambot/tests/github_integration.rs	The test fixture now uses ghs_test-token and retains the existing prefix and parsing assertions.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to c3314

The changes preserve the literal shell message and update only a test token fixture, with no remaining merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the shell-script fix for unintended command substitution caused by backticks in a double-quoted echo.
Description check	✅ Passed	The description directly explains the command-substitution defect, the fix, and the ShellCheck validation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch fix/shellcheck-parse-error

🛠️ Fix failing CI checks

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit sees backticks stay still
The shell prints each mark by will
A test token takes a shorter trail
Its ghs_ prefix does not fail
Small changes pass the checking gate}

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The PR correctly identifies and addresses a command substitution bug in scripts/fix-close-obsolete-pr.sh where backticks within double quotes were being executed. However, the current solution of switching to single quotes has triggered a new ShellCheck warning, resulting in the PR being flagged as not up to standards by Codacy.

To resolve this and satisfy the linter while maintaining the fix, the backticks should be escaped within double quotes. Additionally, there is a lack of automated or manual verification scenarios provided in the code to ensure the output remains correct after these changes.

Test suggestions

• Execute the script with a PR diff containing no matching lines and verify the output is 'SKIP: PR has no + uses: …@<sha> lines' without shell execution errors.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Execute the script with a PR diff containing no matching lines and verify the output is 'SKIP: PR has no `+ uses: …@<sha>` lines' without shell execution errors.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
36740420	Triggered	Generic Password	b84e2f0	bots/cipherbot/src/analyzers/infra.rs	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[coderabbitai]

ℹ️ Nothing to fix from this PR. All 4 failing check(s) are already failing on main, so they aren't caused by your changes.

⏭️ 4 check(s) skipped — already failing on `main` (not caused by this PR)

• GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt
• GitHub Actions: Hypatia Security Scan / hypatia _ Hypatia Neurosymbolic Analysis
• GitHub Actions: Hypatia Security Scan / hypatia _ Hypatia Neurosymbolic Analysis
• GitHub Actions: Hypatia Security Scan / hypatia _ Hypatia Neurosymbolic Analysis

These need to be addressed on main (or by whoever owns them), not in this PR.

[coderabbitai]

🤖 Completed: Resolve merge conflicts in PR #492 — View commit 769b890