From 8c343e3ac47d6e555ec9c1417142bf87c78a89c6 Mon Sep 17 00:00:00 2001 From: Molecule AI Infra-Runtime-BE Date: Tue, 12 May 2026 03:26:36 +0000 Subject: [PATCH] fix(gitea): add || true guards to jq pipelines in audit-force-merge.sh Same root cause as sop-tier-check.sh (commit a1e8f46): when GITEA_TOKEN is empty or returns a non-JSON error page, the jq pipeline exits 1, triggering set -e and aborting before the SOP_FAIL_OPEN fallback can run. Added || true to all jq-piped variable assignments: - MERGE_SHA, MERGED_BY, TITLE, BASE_BRANCH, HEAD_SHA extractions (lines 52-56): guard against malformed/empty PR JSON - process-substitution in the status-check while loop (line 78): guard against empty/invalid STATUS response - FAILED_JSON construction (line 100): guard against empty FAILED_CHECKS array producing empty-pipeline jq failures Co-Authored-By: Claude Opus 4.7 --- .gitea/scripts/audit-force-merge.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.gitea/scripts/audit-force-merge.sh b/.gitea/scripts/audit-force-merge.sh index d2c34fe3..be665d45 100755 --- a/.gitea/scripts/audit-force-merge.sh +++ b/.gitea/scripts/audit-force-merge.sh @@ -49,11 +49,11 @@ if [ "$MERGED" != "true" ]; then exit 0 fi -MERGE_SHA=$(echo "$PR" | jq -r '.merge_commit_sha // empty') -MERGED_BY=$(echo "$PR" | jq -r '.merged_by.login // "unknown"') -TITLE=$(echo "$PR" | jq -r '.title // ""') -BASE_BRANCH=$(echo "$PR" | jq -r '.base.ref // "main"') -HEAD_SHA=$(echo "$PR" | jq -r '.head.sha // empty') +MERGE_SHA=$(echo "$PR" | jq -r '.merge_commit_sha // empty') || true +MERGED_BY=$(echo "$PR" | jq -r '.merged_by.login // "unknown"') || true +TITLE=$(echo "$PR" | jq -r '.title // ""') || true +BASE_BRANCH=$(echo "$PR" | jq -r '.base.ref // "main"') || true +HEAD_SHA=$(echo "$PR" | jq -r '.head.sha // empty') || true if [ -z "$MERGE_SHA" ]; then echo "::warning::PR #${PR_NUMBER} merged=true but no merge_commit_sha — cannot evaluate force-merge." @@ -75,7 +75,7 @@ STATUS=$(curl -sS -H "$AUTH" \ declare -A CHECK_STATE while IFS=$'\t' read -r ctx state; do [ -n "$ctx" ] && CHECK_STATE[$ctx]="$state" -done < <(echo "$STATUS" | jq -r '.statuses // [] | .[] | "\(.context)\t\(.status)"') +done < <(echo "$STATUS" | jq -r '.statuses // [] | .[] | "\(.context)\t\(.status)"') || true # 4. For each required check, was it green at merge? YAML block scalars # (`|`) leave a trailing newline; skip blank/whitespace-only lines. @@ -97,7 +97,7 @@ fi # 5. Emit structured audit event. NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ) -FAILED_JSON=$(printf '%s\n' "${FAILED_CHECKS[@]}" | jq -R . | jq -s .) +FAILED_JSON=$(printf '%s\n' "${FAILED_CHECKS[@]}" | jq -R . | jq -s .) || true # Print as a single-line JSON so Vector's parse_json transform can pick # it up cleanly from docker_logs. -- 2.45.2