From fcd00859911604d3bcbc8064b488712c4fb47eda Mon Sep 17 00:00:00 2001
From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Date: Fri, 28 Aug 2026 11:02:43 +0200
Subject: [PATCH] fix(ci): the hosted-Supabase test died on the runner instead
 of reporting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI went red on main with exit 128 and no failure line — the suite stopped
mid-file, naming nothing.

Two causes, both mine. Sourcing the audit to get at its pure helpers also runs
its `set -euo pipefail` in the test's shell, so the first command that failed
took the whole suite with it. And the fixture repo committed with whatever git
identity happened to be lying around; a GitHub runner has none, so `git commit`
exits 128. Locally both were invisible: my identity is configured, so nothing
ever failed at that line.

A test suite whose job is to run commands that fail must not die on the first
one. Take -e back after sourcing, keep -u and pipefail, and give the fixture an
explicit identity so it does not care what the machine has.

Verified the way it actually breaks, not the way it passes:
HOME=$(mktemp -d) GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null
reproduces exit 128 before the fix and 28/28 after.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018waGt1ieA9TjpscqrbrnGb
---
 scripts/ci/test-hosted-supabase-audit.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/scripts/ci/test-hosted-supabase-audit.sh b/scripts/ci/test-hosted-supabase-audit.sh
index 36ebe16..39020ba 100755
--- a/scripts/ci/test-hosted-supabase-audit.sh
+++ b/scripts/ci/test-hosted-supabase-audit.sh
@@ -29,6 +29,13 @@ export HOSTED_SUPABASE_AUDIT_LIB_ONLY=1
 source "$SCRIPT"
 unset HOSTED_SUPABASE_AUDIT_LIB_ONLY
 
+# Sourcing the audit runs its `set -euo pipefail` in OUR shell. A test suite
+# whose whole job is to run commands that fail must not die on the first one:
+# on a GitHub runner `git commit` exits 128 for want of an identity, and this
+# suite stopped mid-file with 128 and no failure report — a red that named
+# nothing. Take -e back; keep -u and pipefail.
+set +e
+
 echo "hosted_pattern — the shapes that actually misled someone"
 matches 'https://supabase.com/dashboard/project/_/sql'                "a dashboard link, botsmann's documented migration step"
 matches 'https://supabase.com/dashboard/account/tokens'               "the account-tokens link orangecat's runbook carried"
@@ -75,7 +82,9 @@ echo "repo_ref — audit what is SHARED, not a session's stale checkout"
 D="$(mktemp -d)"
 trap 'rm -rf "$D" "$TMP"' EXIT
 git -C "$D" init -q 2>/dev/null
-git -C "$D" commit -q --allow-empty -m init 2>/dev/null
+# Explicit identity: a runner has none, and this fixture must not care.
+git -C "$D" -c user.email=test@example.invalid -c user.name=test \
+    -c commit.gpgsign=false commit -q --allow-empty -m init 2>/dev/null
 eq HEAD "$(repo_ref "$D")" "no remote falls back to HEAD rather than failing the sweep"
 git -C "$D" update-ref refs/remotes/origin/main HEAD
 eq origin/main "$(repo_ref "$D")" "origin/main wins — a local main 4 commits stale reports fixed files as broken"