Skip to content

norm: auto-fix CI for run 30706544211 - #16

Merged
natevick merged 2 commits into
mainfrom
norm/ci-fix-30706544211
Aug 2, 2026
Merged

norm: auto-fix CI for run 30706544211#16
natevick merged 2 commits into
mainfrom
norm/ci-fix-30706544211

Conversation

@natevick

@natevick natevick commented Aug 1, 2026

Copy link
Copy Markdown
Owner

⚠️ Auto-generated fix — please review. Produced automatically by norm-webhooks
in response to a CI failure; it was not written by a human. Review carefully before merging.

Auto-fix for CI failure on ab585f778fb7702f782bf1959879474406f2a366 (run 30706544211).

Run: https://github.com/natevick/dotfiles/actions/runs/30706544211

failed-job logs (fetched at fix time)
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:33.3615946Z ##[group]Run shellcheck install.sh home/*.sh
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:33.3617804Z ^[[36;1mshellcheck install.sh home/*.sh^[[0m
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:33.3619632Z ^[[36;1m# ~/.local/bin shims. These shadow real binaries on $PATH (gh, git),^[[0m
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:33.3621837Z ^[[36;1m# so they are the most consequential shell in the repo  they were^[[0m
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:33.3623822Z ^[[36;1m# previously outside the linter's reach entirely.^[[0m
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:33.3625407Z ^[[36;1mshellcheck home/dot_local/bin/*^[[0m
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:33.3627165Z ^[[36;1mshellcheck --shell=bash home/dot_claude/modify_settings.json^[[0m
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:33.3683524Z shell: /usr/bin/bash -e {0}
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:33.3684708Z ##[endgroup]
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:34.0914045Z 
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:34.0915441Z In home/dot_local/bin/executable_claude-memory-backup line 18:
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:34.0917346Z cd "$WORK" && git pull --rebase -q origin main 2>/dev/null || true
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:34.0919643Z            ^-- SC2015 (info): Note that A && B || C is not if-then-else. C may run when A is true.
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:34.0921135Z 
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:34.0921542Z For more information:
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:34.0923084Z   https://www.shellcheck.net/wiki/SC2015 -- Note that A && B || C is not if-t...
shellcheck	shellcheck plain shell scripts	2026-08-01T15:43:34.0965027Z ##[error]Process completed with exit code 1.

Norm and others added 2 commits August 1, 2026 08:43
PR #12 added a gitconfig pointing at a credential helper the repo did not
contain, so a rebuilt agent host got config with nothing behind it. Ship the
three shims it depends on:

  gh                        injects the per-org PAT, resolving owner from
                            -R/--repo, GH_REPO, an `gh api` path, a POSITIONAL
                            owner/repo, or the cwd's origin. No default-org
                            fallback: a repo-less call runs unauthenticated
                            rather than quietly carrying an org credential.
  git                       refuses force-push and branch-delete, audits, and
                            notifies. An ACCIDENT CATCHER, not a control —
                            anything running as the agent can call /usr/bin/git
                            or set NORM_ALLOW_FORCE=1. It fails OPEN to real git
                            by design; breaking every git call would be worse
                            than missing one force-push.
  git-credential-github-org one PAT per org, keyed on the remote URL's owner.

All three append to ~/.local/state/norm-gh-audit.jsonl (0600, created before
first write — the ambient umask would otherwise leave it world-readable). The
token value is never logged.

Gated in .chezmoiignore on .agent: `gh` and `git` SHADOW the real binaries, so
on a host without ~/.config/github-pats they would break github.com auth
outright. Verified both renderings with --override-data.

Also wire home/dot_local/bin/* into the shellcheck job. Those files shadow real
binaries and were outside the linter's reach; all four pass clean (0.11.0).
@natevick
natevick merged commit d011de8 into main Aug 2, 2026
3 checks passed
@natevick
natevick deleted the norm/ci-fix-30706544211 branch August 2, 2026 14:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant