From b2522336021f5c7cb8315dbd885c909ea79bb968 Mon Sep 17 00:00:00 2001
From: "qodo-code-review[bot]"
 <151058649+qodo-code-review[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 17:28:50 +0000
Subject: [PATCH] fix: Propagate ripgrep filter errors

---
 scripts/public-repo-guard/body-policy.sh | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/scripts/public-repo-guard/body-policy.sh b/scripts/public-repo-guard/body-policy.sh
index a0b421f..fb7e038 100755
--- a/scripts/public-repo-guard/body-policy.sh
+++ b/scripts/public-repo-guard/body-policy.sh
@@ -49,10 +49,19 @@ check() {
   # Filter with rg, not grep: BSD/macOS grep has no -P, so a `grep -P` allowlist
   # silently errors out locally while working on GNU/CI — the gate would then
   # disagree with itself depending on where it ran. rg is already required above.
-  local matches
-  matches="$(printf '%s' "$raw" \
-    | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' \
-    | rg -vNiP -- "$ABOUT_THE_CONTROL" || true)"
+  local allowlisted rc matches
+  allowlisted="$(printf '%s' "$raw" \
+    | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]')"; rc=$?
+  if (( rc >= 2 )); then
+    echo "::error title=public-repo-guard ($name)::ripgrep failed (exit $rc) filtering allowlisted lines for rule '$name' — failing closed."
+    exit 2
+  fi
+  matches="$(printf '%s' "$allowlisted" \
+    | rg -vNiP -- "$ABOUT_THE_CONTROL")"; rc=$?
+  if (( rc >= 2 )); then
+    echo "::error title=public-repo-guard ($name)::ripgrep failed (exit $rc) filtering control references for rule '$name' — failing closed."
+    exit 2
+  fi
   [[ -z "$matches" ]] && return 0
   local count; count="$(printf '%s\n' "$matches" | grep -c '')"
   # Print the LINE NUMBER only — never the matched text. This annotation is itself