From dc0924627ad34be6cc89a3ec8b5f7ac8f2049bd7 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 16 Sep 2026 18:03:00 +0200
Subject: [PATCH] Make three fail-open lints fail loudly

check-attribution-trailers.sh: the origin/main fallback now fails
loudly if it cannot fetch/resolve origin/main, instead of silently
substituting HEAD~10 as the diff base.

check-comment-blocks.sh and check-issue-refs.sh: assert the tracked
file-list search matched at least one file before treating an empty
hit-set as clean, mirroring the existing assertion in
check-doc-refs.sh.

Refs 4442, fixes 4439
---
 scripts/check-attribution-trailers.sh |  5 ++++-
 scripts/check-comment-blocks.sh       | 10 ++++++++++
 scripts/check-issue-refs.sh           | 10 ++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/scripts/check-attribution-trailers.sh b/scripts/check-attribution-trailers.sh
index c2fc2b73..82cd63dc 100755
--- a/scripts/check-attribution-trailers.sh
+++ b/scripts/check-attribution-trailers.sh
@@ -28,7 +28,10 @@ if ! git rev-parse --verify "$base" >/dev/null 2>&1; then
   git fetch origin "$branch" 2>/dev/null || true
   if ! git rev-parse --verify "$base" >/dev/null 2>&1; then
     base="origin/main"
-    git fetch origin main 2>/dev/null || base="HEAD~10"
+    if ! git fetch origin main 2>/dev/null || ! git rev-parse --verify "$base" >/dev/null 2>&1; then
+      echo 'check-attribution-trailers: base ref unresolvable — cannot fetch origin/main to diff against, refusing to guess a commit range' >&2
+      exit 1
+    fi
   fi
 fi
 
diff --git a/scripts/check-comment-blocks.sh b/scripts/check-comment-blocks.sh
index 12efd75b..e4d796e3 100755
--- a/scripts/check-comment-blocks.sh
+++ b/scripts/check-comment-blocks.sh
@@ -20,6 +20,16 @@ set -eu
 
 MAX=30
 
+# A lint whose file-list matches nothing passes forever while checking not
+# one file — mirrors the assertion in scripts/check-doc-refs.sh. If a rename
+# or extension-list edit silences `git ls-files` here, that is a failure of
+# this script, not a property of the tree.
+file_count="$(git ls-files '*.rs' '*.nix' '*.sh' '*.js' '*.mjs' '*.ts' '*.tsx' '*.css' '*.html' | wc -l)"
+if [ "$file_count" -eq 0 ]; then
+  echo 'check-comment-blocks: file-list search matched nothing — pattern or tree changed' >&2
+  exit 1
+fi
+
 # Collect annotations into a variable (not via xargs/awk exit codes) so a
 # hit in any xargs batch is preserved — mirrors scripts/check-issue-refs.sh.
 hits="$(
diff --git a/scripts/check-issue-refs.sh b/scripts/check-issue-refs.sh
index 245851e5..943906b2 100755
--- a/scripts/check-issue-refs.sh
+++ b/scripts/check-issue-refs.sh
@@ -28,6 +28,16 @@ set -eu
 
 pattern='#[0-9]{2,5}([^0-9a-zA-Z]|$)|/issues/[0-9]+([^0-9a-zA-Z]|$)'
 
+# A lint whose file-list matches nothing passes forever while checking not
+# one file — mirrors the assertion in scripts/check-doc-refs.sh. If a rename
+# or extension-list edit silences `git ls-files` here, that is a failure of
+# this script, not a property of the tree.
+file_count="$(git ls-files '*.rs' '*.nix' '*.js' '*.mjs' '*.ts' '*.tsx' '*.css' '*.html' '*.md' '*.yml' '*.yaml' | wc -l)"
+if [ "$file_count" -eq 0 ]; then
+  echo 'check-issue-refs: file-list search matched nothing — pattern or tree changed' >&2
+  exit 1
+fi
+
 # `/dev/null` forces grep to always print a filename prefix, even when
 # xargs hands it a single file. `-r`/`-0` keep it robust to odd paths and
 # an empty file list. Lines carrying the `lint:allow` marker are dropped