Harden fixer paths, modifications, disabling, and commits

.github/workflows/dogfood-gate.yml

@@ -150,7 +150,7 @@ jobs:
           # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,
           # non-breaking spaces, null bytes, and other invisible Unicode in source files.
           set +e
-          PATTERNS='\xc2\xa0|\xe2\x80\x8b|\xe2\x80\x8c|\xe2\x80\x8d|\xef\xbb\xbf|\xc2\xad|\xe2\x80\x8e|\xe2\x80\x8f|\xe2\x80\xaa|\xe2\x80\xab|\xe2\x80\xac|\xe2\x80\xad|\xe2\x80\xae|\x00'
+          PATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]'
           find "$GITHUB_WORKSPACE" \
             -not -path '*/.git/*' -not -path '*/node_modules/*' \
             -not -path '*/.deno/*' -not -path '*/target/*' \
@@ -161,7 +161,7 @@ jobs:
               -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \
               -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \
               -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \
-            -exec grep -Prl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null
+            -exec grep -aPl "$PATTERNS" {} + > /tmp/empty-lint-results.txt 2>/dev/null
           EL_EXIT=$?
           set -e
 

bots/seambot/tests/github_integration.rs

@@ -153,7 +153,7 @@ mod tests {
         let response = r#"{
             "token": "ghs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
             "expires_at": "2024-01-15T12:00:00Z"
-        }"#;
+        }"#; // gitleaks:allow -- placeholder token (all 'x's), not a real credential
 
         let parsed: serde_json::Value = serde_json::from_str(response).unwrap();
         assert!(parsed["token"].as_str().unwrap().starts_with("ghs_"));

dashboard/src/main.rs

@@ -175,7 +175,11 @@ async fn report_handler(
 
     match format.to_lowercase().as_str() {
         "html" => (StatusCode::OK, [("content-type", "text/html")], report),
-        "json" => (StatusCode::OK, [("content-type", "application/json")], report),
+        "json" => (
+            StatusCode::OK,
+            [("content-type", "application/json")],
+            report,
+        ),
         _ => (StatusCode::OK, [("content-type", "text/plain")], report),
     }
 }
@@ -211,10 +215,7 @@ async fn websocket_handler(
 }
 
 /// Handle WebSocket connection
-async fn websocket_connection(
-    mut socket: axum::extract::ws::WebSocket,
-    state: AppState,
-) {
+async fn websocket_connection(mut socket: axum::extract::ws::WebSocket, state: AppState) {
     use axum::extract::ws::Message;
     use tokio::time::{interval, Duration};
 

robot-repo-automaton/README.adoc

@@ -316,6 +316,10 @@ The error catalog uses S-expression format (Guile Scheme compatible):
 | Apply a line-level transformation. Requires a `modification` field with spec
   such as `replace-line:N:content`, `insert-before:N:content`,
   `replace-pattern:regex:replacement`, `prepend:content`, or `append:content`.
+  For `replace-pattern`, the first unescaped colon separates the regex and
+  replacement. Write a colon within either field as `\:` (for example,
+  `replace-pattern:https?\://old:https\://new`). Regex replacement expansion is
+  preserved, so capture references such as `$1` and `$name` are supported.
 
 | `create`
 | Create the target file from a template or `fallback` content. Supports