feat: implement issue #342 — [Fleet Monitor] petry-projects/.github-private — lint.yml

[don-petry]

Closes #342

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 6 minutes and 47 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ea8d55da-2de0-4f39-9451-c239595e742e

📥 Commits

Reviewing files that changed from the base of the PR and between 19a235a and 0561564.

📒 Files selected for processing (1)

• .github/workflows/lint.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-342-20260609-2108

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[Copilot]

Pull request overview

This PR targets issue #342 by adjusting the repo’s lint workflow behavior, primarily around ShellCheck execution, with an additional (unrelated) tweak to the CI Failure Analyst agentic workflow trigger configuration.

Changes:

• Updated .github/workflows/lint.yml ShellCheck invocation to use -x and globbed script paths.
• Updated .github/workflows/ci-failure-analyst.md to add a branches: ["**"] filter under workflow_run.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/lint.yml	Broadens and changes how ShellCheck is executed (adds -x, switches from explicit file list to globs).
.github/workflows/ci-failure-analyst.md	Adds a branch filter to the workflow_run trigger configuration.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-09T22:06:13Z

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #524
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-10T00:17:02Z

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

Superseded by automated re-review at b354e28.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Dev-Lead — rebase (no-changes)

Agent reasoning

PR: #524
Rebased onto: main
Conflicts resolved: 1 file
- .github/workflows/lint.yml: kept PR's change (shellcheck wildcard glob + -x flag)
  over main's explicit file list; a pre-commit hook further improved the command
  to use `find scripts -name "*.sh" -exec shellcheck --severity=warning -x {} +`
Push: success
```
The branch was restructured from 349 entangled commits (full repo history + merge commits) down to 2 clean commits on top of main, then force-pushed successfully.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
No actionable findings: SonarCloud Quality Gate passed with 0 new issues and
0 security hotspots. No open review threads from sonarqubecloud[bot] exist.
PR diff contains no SonarQube hotspot patterns. No Tier 1 CI blockers present.
```

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 056156466a3862b3c430fc423698dd16d77b134c
Review mode: triage-approved (single reviewer)

Summary

Broadens the lint workflow's shellcheck job to cover all scripts/**/*.sh and adds -x so source directives resolve cleanly. Targeted fix for issue #342 (Fleet Monitor warning on lint.yml).

Linked issue analysis

Closes #342, a Fleet Monitor health-check tracking a 13.3% failure rate on lint.yml. Replacing the hardcoded 6-script allowlist with a recursive find means newly added shell scripts can't silently bypass shellcheck, which is the right shape of fix for a workflow whose failure mode was missing/changing files. The job still pins --severity=warning (preserving the SC2016 noise-suppression rationale already documented in the inline comment).

Findings

No blocking findings.

• Coverage now includes scripts/lib/**/*.sh transitively, which is broader than the prior list — desired behavior, and the shellcheck check passed on this commit confirming all scripts currently meet --severity=warning with -x resolution.
• find ... -exec shellcheck ... {} + groups args into one or more shellcheck invocations; if no .sh files were found, shellcheck would be invoked with zero args and error. Not a concern here (scripts/ is well-populated and the job passed), but worth noting if scripts/ is ever emptied.
• Inline comment on -x is accurate and helpful for future maintainers.

CI status

All required checks green on 0561564: Lint, ShellCheck, shellcheck (lint), bats, unit-tests, CodeQL (actions/python), Secret scan (gitleaks), Agent Security Scan, AgentShield, validate-agent-profiles, Compile agentic workflows, gh-aw-compile, SonarCloud (Quality Gate passed, 0 new issues), CodeRabbit. Dependency-audit shards skipped (no matching ecosystems). Only review/review still IN_PROGRESS (this run).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 056156466a3862b3c430fc423698dd16d77b134c
Review mode: triage-approved (single reviewer)

Summary

Broadens the lint workflow's shellcheck step to cover all scripts/**/*.sh via a find glob (replacing a hand-maintained file list) and adds -x so source directives are followed. CI-only change — no runtime or security impact.

Linked issue analysis

Closes #342, a Fleet Monitor health-check warning about a 13.3% failure rate on lint.yml. The PR broadens shellcheck coverage and follows source directives, which reasonably reduces drift between the hand-maintained list and the actual scripts in the repo. The fleet-tracker issue is informational, so substantive resolution is the workflow hygiene improvement itself.

Findings

No issues.

• The new find ... -exec shellcheck ... {} + pattern is correct and runs in a single shellcheck invocation per batch.
• -x is the right way to handle the # shellcheck source= annotations present in the repo's scripts.
• The shellcheck job passed under the new pattern, confirming all newly-covered scripts still lint clean at warning severity.
• Severity comment on the previous line remains accurate.

CI status

All required checks green: Lint/shellcheck, Lint/bats, Lint/validate-agent-profiles, Lint/gh-aw-compile, CodeQL (actions + python), CI/ShellCheck, CI/Agent Security Scan, CI/Compile agentic workflows, CI/Secret scan (gitleaks), SonarCloud (quality gate passed, 0 new issues), unit-tests, dependency-audit, AgentShield. Dev-Lead dispatch and this review job are in-flight and don't block.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.