Skip to content

fix(ci): the invisible-character gate never matched anything - #56

Open
hyperpolymath wants to merge 1 commit into
mainfrom
fix/empty-linter-pattern-never-matched
Open

fix(ci): the invisible-character gate never matched anything#56
hyperpolymath wants to merge 1 commit into
mainfrom
fix/empty-linter-pattern-never-matched

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Measured 2026-08-27: this gate caught 0 of 6 invisible-character test cases. It has never detected an NBSP, zero-width space, BOM, soft hyphen, bidi override or word joiner.

Root cause

The pattern used UTF-8 byte sequences (\xc2\xa0) while grep -P matches characters. Bytes c2 a0 are one character U+00A0; \xc2\xa0 asks for two, U+00C2 then U+00A0 — never present.

grep -P '\xc2\xa0'  ->  miss
grep -P '\x{a0}'    ->  MATCH

Only \x00 worked, being single-byte in both readings. The gate ran, passed, and could not see what it exists to see.

Fixed

  • codepoint escapes in place of byte sequences
  • C0 controls \x01-\x08,\x0B,\x0C,\x0E-\x1F added (TAB/LF/CR excluded)
  • grep -a — without it grep skips any NUL-bearing file as binary

The C0 range matters: a stray backspace byte made a workflow unparseable in developer-ecosystem, so it never ran — and this linter called it clean.

Canonical fix: hyperpolymath/empty-linter#70. 1 file(s) here.

Verified: YAML re-parsed, and the corrected pattern was confirmed to catch a real NBSP before the change was kept.

MEASURED 2026-08-27: this gate's pattern caught 0 OF 6 invisible-character test
cases. It has never detected an NBSP, zero-width space, BOM, soft hyphen, bidi
override or word joiner.

ROOT CAUSE: the pattern used UTF-8 BYTE sequences (\xc2\xa0) while grep -P
matches CHARACTERS. Bytes c2 a0 are ONE character U+00A0; \xc2\xa0 asks for TWO
characters, U+00C2 then U+00A0, which is never present.

  grep -P '\xc2\xa0'  ->  miss
  grep -P '\x{a0}'    ->  MATCH

Only \x00 worked, being single-byte in both readings.

FIXED: codepoint escapes; C0 control characters \x01-\x08,\x0B,\x0C,\x0E-\x1F
added (TAB/LF/CR excluded); and grep -a, without which grep skips any NUL-bearing
file as binary.

The C0 range matters: a stray BACKSPACE byte made a workflow unparseable in
developer-ecosystem, so it never ran, and this linter called it clean.

Canonical fix: hyperpolymath/empty-linter#70. 1 file(s) here.
VERIFIED: YAML re-parsed, and the corrected pattern was confirmed to catch a real
NBSP before the change was kept.
@coderabbitai

coderabbitai Bot commented Aug 27, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c59be8ed-b64a-46ae-afb6-f400371c028a

📥 Commits

Reviewing files that changed from the base of the PR and between 595dcaf and 8d251af.

📒 Files selected for processing (1)
  • .github/workflows/dogfood-gate.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (12)
  • GitHub Check: Gitar
  • GitHub Check: Codacy Static Code Analysis
  • GitHub Check: Validate eclexiaiser manifest
  • GitHub Check: Empty-linter (invisible characters)
  • GitHub Check: Groove manifest check
  • GitHub Check: Validate K9 contracts
  • GitHub Check: Hypatia neurosymbolic scan
  • GitHub Check: panic-attack assail
  • GitHub Check: analyze (javascript-typescript, none)
  • GitHub Check: Validate A2ML manifests
  • GitHub Check: Patch Bridge CVE triage
  • GitHub Check: openssf-compliance
🔇 Additional comments (1)
.github/workflows/dogfood-gate.yml (1)

131-131: 🎯 Functional Correctness

Do not add a separate leading-BOM check for this reason.

GNU grep 3.8 rejects \x{feff} with character code point value in \x{} or \o{} is too large before PCRE matching. A missed file therefore does not show that grep removes a leading BOM. It shows that the pattern is rejected.


📝 Walkthrough

Summary by CodeRabbit

  • Bug Fixes
    • Improved detection of invisible, control, and formatting characters during automated checks.
    • Updated scanning to handle binary files as text, improving consistency of validation results.

Walkthrough

The empty-lint workflow job now detects invisible characters with Unicode code-point escapes. It also scans binary files as text, including files containing null bytes.

Changes

Invisible-character gate

Layer / File(s) Summary
Pattern and scan update
.github/workflows/dogfood-gate.yml
The PATTERNS regex now covers control, non-breaking space, soft hyphen, zero-width, bidi, word-joiner and BOM code points. The grep command now uses -a with -Prl.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🔵 Low · up to 8d251

The workflow’s invisible-character matcher may reject the BOM expression on GNU grep 3.8, causing the gate to fail or miss BOM-containing files. This is a bounded correctness risk that should be resolved or explicitly accepted before merge.

Poem

A rabbit checks each hidden mark,

With Unicode light against the dark,
Null bytes pass the text-filled gate,
Control codes now meet their fate,
The workflow scans from start to end.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Linked Issues check ⚠️ Warning The changes satisfy the codepoint escape, C0 control, and grep -a requirements in [#70]. They do not show the required separate leading-BOM check or matching updates to the compiled linter in stdlib/B… Add the separate byte-wise leading-BOM check and update stdlib/ByteDetector.affine and config.ncl with the same C0-control detection, or provide evidence that these requirements are implemented elsewhere in this pull request.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: fixing the CI invisible-character gate, which matches the pull request changes.
Description check ✅ Passed The description clearly states the root cause, implemented fixes, affected character classes, and verification results. It does not use all template headings or include the checklist, but the required…
Out of Scope Changes check ✅ Passed The modified workflow pattern is directly related to the invisible-character gate requirements in [#70]. No unrelated code changes are shown.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Full details: Description check

Explanation

The description clearly states the root cause, implemented fixes, affected character classes, and verification results. It does not use all template headings or include the checklist, but the required technical information is mostly present.

Full details: Linked Issues check

Explanation

The changes satisfy the codepoint escape, C0 control, and grep -a requirements in [#70]. They do not show the required separate leading-BOM check or matching updates to the compiled linter in stdlib/ByteDetector.affine and config.ncl.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

  • Fix all pre-merge checks with AI

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

Copy link
Copy Markdown

@gitar-bot

gitar-bot Bot commented Aug 27, 2026

Copy link
Copy Markdown

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

Gitar

@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

Run reviewer

TIP This summary will be updated as you push new changes.

@codacy-production codacy-production Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

The transition to PCRE-compatible codepoint escapes and the expanded character range (including C0 control characters) addresses the identified failure in the invisible-character gate. While the PR meets Codacy quality standards, the absence of automated regression tests for these regex patterns increases the risk of future silent failures. Additionally, the command used for file scanning in the workflow is currently inefficient and potentially unreliable for capturing aggregate exit statuses; optimizing this via file batching is recommended.

About this PR

  • There are no automated regression tests (such as a sample 'dirty' file) within the repository to verify that the new regex patterns remain effective or to prevent future regressions. It is recommended to add a test script or a dedicated test file containing these invisible characters to ensure the gate remains functional.

Test suggestions

  • Verify detection of Non-Breaking Space (U+00A0)\n- [ ] Verify detection of C0 control character like Backspace (U+0008)\n- [ ] Verify detection of Byte Order Mark (U+FEFF)\n- [ ] Verify that a file containing a null byte is scanned rather than skipped
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify detection of Non-Breaking Space (U+00A0)\n- [ ] Verify detection of C0 control character like Backspace (U+0008)\n- [ ] Verify detection of Byte Order Mark (U+FEFF)\n- [ ] Verify that a file containing a null byte is scanned rather than skipped

TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback

-o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \
-o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \
-exec grep -Prl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null
-exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

Suggestion: The current implementation uses 'find -exec ... {} ;' which is inefficient because it spawns a separate 'grep' instance for every file. Switching to '+' allows 'find' to batch files, significantly improving performance and ensuring the exit status 'EL_EXIT' more reliably reflects whether matches were found across the entire set. Additionally, the '-r' flag is redundant when used with 'find', and adding '--' is a best practice to protect against filenames starting with hyphens.\n\nsuggestion\n -exec grep -aPl "$PATTERNS" -- {} + > /tmp/empty-lint-results.txt 2>/dev/null\n

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant