[brettheap]

Lane: openreposhape-3 (openRepoShape-3)
Claim: #786 (comment)

Closes #786.

Was stacked on #782, which has landed as squash a9d15797 and is merged in (see the merge round). The siblings rows skip until #775 is on main. The v1.1.0 tag is out (190133d5).

This branch holds #782's two commits (1bb59b6a, 67324e91), three of its own (85754e2f, 24df81cb, 31c3792c), the merge round's three merges, and one more of its own (e91b1a5d). Its diff against main is #786 alone: the changed lines of git diff 67324e91 31c3792c with the handbook markers recomputed, and the CR-row commit.

What changed and why

The two validate.yml templates read every .url key of .gitmodules, at three sites each: the names step (the repositories the App token is minted for), the fetch step's list of urls, and the failing step's list. So CI named repositories git never fetches. RV-c measured these on #782 (SHOULD 3): [submodule ""] and [submodule "../a"], a section with a url and no path, a [remote "origin"] url or [-x] url in .gitmodules, a bare url that makes git refuse the whole file, and url = -oProxyCommand=x. Where the App installation cannot reach such a repository, the mint step failed the job, though git would never fetch it.

Now all three sites, in both templates, read the file by the rules the doctor and siblings.py read it by (#733, #775's submodule_urls, git_dies_on and the constants):

• Only a submodule.?*.url key counts (case $key in submodule.?*.url) ;; *) continue ;; esac).
• A section whose name holds a .. component, between / or \, is skipped (case /$name/ in *[/\\]..[/\\]*)). An empty name is the ?*.
• A section with no path is skipped.
• A value beginning with - is ignored, that value alone, so an earlier one stands: both reads pass git a value pattern, --get -- "$key" '^([^-]|$)' for the url and --get -- "submodule.$name.path" '^([^-]|$)' for the path. url = A then url = -x is A, as git submodule init, the doctor and siblings.py have it.
• Nothing is read while .gitmodules is unmerged: git ls-files -u -- .gitmodules must say nothing.
• A file git refuses whole is refused. The step prints ::error::.gitmodules holds <cause>, so git refuses the whole file: it reads none of it, and no repository is named from it. git submodule status names the key and line git stops at. and exits 1, naming nothing. Each cause names the key git stops at, escaped as workflow-command data (% and CR): a path, url, ignore, update or branch key with no value; an update other than none, checkout, rebase or merge; a shallow that is no boolean; a fetchRecurseSubmodules that is neither a boolean nor on-demand (compared as git does, case-sensitively), each in a section git reads. A file git cannot parse prints git's own fatal: text instead: .gitmodules holds a line git cannot parse (bad config line 5 in file .gitmodules), so git refuses ….

#782's reading stays: --name-only, --get -- "$key", the line-break skip and the duplicate check.

How the refusal is read, and why. The file is read once as git config -z --file .gitmodules --list, mapped with tr '\000\n' '\n\001' so that each record is one line, key, then a \001 and the value when it has one. A key has no value at all only where the record has no \001, which is how a bare url is told from url =, and a value with a newline cannot start a record of its own. That is POSIX shell: no read -d '', no $'\n'. The booleans (shallow, fetchRecurseSubmodules) are asked of the runner's own git, git -c x.y=<value> config --type=bool --get x.y, so CI and git submodule agree on a value like 0x10 or 2 by construction, with no table of ours to drift.

Changed, with line numbers in the new files (the refusal, then the key rules, at each site):

• templates/assembly-root/.github/workflows/validate.yml: the step comment :71-84; the names step :93-138 (refusal :94-127, its parse check :97, key rules :129-138); the fetch step :245-296 (refusal first, :247-282, then the advice :283, then the list :284-296); the failing step :344-357 (key rules only); the fetch and failing step comments :209-211 and :330-339.
• templates/family-root/.github/workflows/validate.yml: the step comment :67-80; the names step :89-134 (refusal :90-123, its parse check :93, key rules :125-134); the fetch step :246-297 (refusal first, :247-283, then the advice :284, then the list :285-297); the failing step :339-352 (key rules only); the fetch and failing step comments :210-212 and :327-333.
• tests/test_validate_workflow_gitmodules_urls.py: RULES and the tests below; the earlier fixtures gain the path each section needs and a git repository.

One behaviour to review

A .gitmodules that git refuses now fails the fetch step too, with or without a leg credential. Before, a failed fetch with no credential configured was a DEGRADE (green, the pin check skipped with a warning). That degrade is for private legs a default token cannot read. A file git refuses fails the fetch whatever the credential, so a credential cannot cure it, and a green run over a broken .gitmodules hid it. The refusal comes first in the fetch step, BEFORE the App advice (submodule checkout failed … configure a GitHub App …), which is the wrong advice for this file and is not printed. The names step and the fetch step each refuse on their own. The failing step carries no refusal: the fetch step exits 1 on a refused file, so the failing step, which runs only after a fetch that did not, is never reached with one (its comment says so). README.md, docs/handbook.html (markers recomputed), both template READMEs and the two failing-step comments said a run "fails outright only if a credential is configured"; each now says a .gitmodules git refuses fails the run whatever the credential, naming the key or line. README.md grows one line, tests/readme-cap.d/786.txt.

Round 2 (RV-c's review of 85754e2: NOT READY, three SHOULDs)

• SHOULD 1, a later - value: the 12 url and mount reads become the value-pattern reads above, and the step comment says "a value that begins with -, that value alone". Round 1's reason, that --get returns one whole value, held for the line-break skip and not against a pattern. Rows for url = A then url = -x, and path = lp then path = -p.
• SHOULD 2, naming the cause: the parse error's fatal: text, the key in every other cause, escaped; "an ignore key", "an update key"; git submodule status names the key and line git stops at; the refusal before the App advice in the fetch step. The cause test asserts the key or the line. The messages are printed with printf '%s\n', which does not read backslashes in a key (..\x) as echo does under dash.
• SHOULD 3, docs: the places above, README and handbook changed together.
• N1: rows for no .gitmodules at all (the names step's [ -f ] guard), fetchRecurseSubmodules = On-Demand (refused), and a bare ignore in [submodule "..\x"] (the refusal's .. test splits at \, so the rest of the file is read).
• N3: the failing step's refusal block is removed.
• N4: this body: the advice is not printed before the refusal, and the parse case names git's own text.
• One change beside the review: the two printing steps list a key once (awk '!seen[$0]++'). --get-regexp lists a key once per value, so url = A then url = B listed B twice, where git registers one url.
• Left, as the coordinator ruled: N2's pathological edges, and the siblings.py split of --list at the first = (handed to lane 4's siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690, and fixed by siblings.py: the printed move runs as typed past a taken staging name and names a dangling link to move aside first, a NUL or lone surrogate in project: or url is a finding, .gitmodules is read as git reads it, the warning's prose is spelled, and a tag-only branch is named (#690) #805's -z read).

Round 3 (NIT, RV-c's review of 24df81c: READY)

• NIT 1, the CR escape had no test. esc turns % and a carriage return into %25 and %0D before a key or git's fatal: text is printed in an ::error:: line (assembly :96, :250; family :92, :251), and removing the CR half left every test passing. A new row has a section named q\rx (path q, update = bogus), and the cause test asserts submodule.q%0Dx.update. With the CR half removed at all four sites, four tests fail (the names and fetch steps, both templates); restored, none do. refusing takes the path a section is mounted at, so the name with a CR keeps a plain path and the git submodule init rows run on Windows. No template change.
• NIT 3's docs edge, said here and not in the docs: a .gitmodules git refuses where the project mounts NO leg makes git exit 0 (there is no gitlink to read it for; measured, git submodule update --init --recursive exits 0), so the fetch step is green and, with no App configured, so is the run. "Fails the run whatever the credential" is said of a project that mounts a leg or a member; for one that mounts none, only the names step refuses it, and only with the App configured. Not changed: the behaviour is git's.
• At this round the siblings.submodule_urls comparison did not ask the CR row: siblings.py cut git config --list with splitlines, which ends a line at a carriage return, so it read ok and never the refused update, where git reads none (measured against shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775's head 3fa5beed). Lane 3 handed this and the split at the first = to lane 4's siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690, and siblings.py: the printed move runs as typed past a taken staging name and names a dangling link to move aside first, a NUL or lone surrogate in project: or url is a finding, .gitmodules is read as git reads it, the warning's prose is spelled, and a tag-only branch is named (#690) #805's -z read fixed both. The merge round below drops the exclusion, so the CR row is asked.

Merge round (main 2e476a7)

#782 (#741) landed as squash a9d15797, #630 (#563) landed as 190133d5, and GitHub retargeted this PR to main. The round is three merges and one commit, a fast-forward of 31c3792c. The head is e91b1a5d.

1. 564898ed merges validate.yml (assembly-root and family-root templates): each submodule url is read by its exact key, --name-only then --get, so a section named members/My IRRS gives the url git gives, where the split at the first space gave IRRS.url <url>, left that repository out of the App token and listed it wrong in both failure steps (#741) #782's final head a59cb537. Its tree is the squash's: git diff --stat a59cb537 a9d15797 is empty.
   • Conflict: only docs/handbook.html, in three hunks. Each is the § The three legs marker (masthead, ci, legs): main's 1d9f5bf9 (README, AGENTS.md, docs/cli.md and the handbook: pipx install openreposhape is the second way in and the first on native Windows, git-filter-repo is installed in install.sh's order and never with a bare pip install, and a first draft of the v1.1.0 release notes (#563) #630's reading) against this branch's a1299381.
   • Resolution: README.md merged clean with both sides standing: README, AGENTS.md, docs/cli.md and the handbook: pipx install openreposhape is the second way in and the first on native Windows, git-filter-repo is installed in install.sh's order and never with a bare pip install, and a first draft of the v1.1.0 release notes (#563) #630's v1.1.0 text, and this PR's sentence in § Reading private legs in CI. The handbook's prose merged clean in the same way. All three markers are set to 4ec313e8424665e41fc92a4147808e0bd4901d78, the blob of the merged README's § The three legs. readme_segments and readme_fingerprint in tests/test_repo_hygiene.py computed it, and git hash-object --no-filters of the segment agrees. The tree is 9f07f48f.
2. 47b9d5fc merges the squash a9d15797.
   • Conflict: validate.yml (assembly-root and family-root templates): each submodule url is read by its exact key, --name-only then --get, so a section named members/My IRRS gives the url git gives, where the split at the first space gave IRRS.url <url>, left that repository out of the App token and listed it wrong in both failure steps (#741) #782's three files: both validate.yml templates (content) and tests/test_validate_workflow_gitmodules_urls.py (add/add).
   • Resolution: each takes this branch's side. That is validate.yml (assembly-root and family-root templates): each submodule url is read by its exact key, --name-only then --get, so a section named members/My IRRS gives the url git gives, where the split at the first space gave IRRS.url <url>, left that repository out of the App token and listed it wrong in both failure steps (#741) #782's final content, byte for byte main's, with this PR's changes on top. No file changes, and the tree stays 9f07f48f.
3. 17cf189a merges main 2e476a77. The merge is clean, and the tree is 1d73091f. It brings in siblings.py: the printed move runs as typed past a taken staging name and names a dangling link to move aside first, a NUL or lone surrogate in project: or url is a finding, .gitmodules is read as git reads it, the warning's prose is spelled, and a tag-only branch is named (#690) #805 (siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690).
4. e91b1a5d drops the CR-row exclusion (below).

Two checks at 17cf189a:

• git diff --name-only origin/main HEAD lists exactly this PR's 8 files.
• Outside the handbook, the -U0 changed lines are byte-identical to those of git diff 67324e91 31c3792c (676 lines).

Skips

• Dropped: the siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690 skip. test_siblings_reads_what_each_row_says left out every row holding a carriage return, because siblings.py cut --list at splitlines. siblings.py: the printed move runs as typed past a taken staging name and names a dangling link to move aside first, a NUL or lone surrogate in project: or url is a finding, .gitmodules is read as git reads it, the warning's prose is spelled, and a tag-only branch is named (#690) #805 closed siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690 with a -z read. The parametrization is now if not rule.unmerged, and the docstring says the CR row is asked. The row is collected as [an update in a section named with a carriage return].
• Kept: the shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775 skip. The siblings fixture skips all 27 rows of test_siblings_reads_what_each_row_says, saying siblings.py has no #733 rules until #775 is in main. It skips while the family template's siblings.py on main lacks shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775's rules (DOTDOT_COMPONENT).
  • What each row checks: it writes its .gitmodules into a fresh repository. It then holds the urls siblings.submodule_urls reads to the urls git submodule init registers.
  • The CR row: it writes ok, then [submodule "q\rx"] with path = q, url = https://github.com/acme/Q.git and update = bogus. git refuses the whole file, so the row expects no url.
  • So the CR row now waits on shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775, not on siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690. Measured:
    • main's siblings.py (siblings.py: the printed move runs as typed past a taken staging name and names a dangling link to move aside first, a NUL or lone surrogate in project: or url is a finding, .gitmodules is read as git reads it, the warning's prose is spelled, and a tag-only branch is named (#690) #805's -z read, no shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775 rules) gives ok and q, so on main the row would fail without the skip;
    • shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775's head 8c5ad0e8 gives none;
    • with shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775's siblings.py laid over this head (not committed), all 27 rows pass, and the file gives 421 passed.

Markers and cap

• All 23 handbook markers are current. handbook_marker_problems and handbook_footer_problems report nothing.
• README.md is 1475 lines, at a cap of 1422 + 2 (460.txt) + 5 (550.txt) + 12 (563.txt) + 22 (564.txt) + 10 (606.txt) + 1 (683.txt) + 1 (786.txt) = 1475. tests/readme-cap.d/786.txt stays +1.
• AGENTS.md is main's: 494 lines, at its cap of 494.

Tests at e91b1a5d, under a stub gh that exits 97, with GH_TOKEN=bogus and an empty GH_CONFIG_DIR:

set	result
the 8 docs files: test_agents_md_codes, test_cli_reference, test_readme_sections, test_readme_windows_quoting_sentence, test_release_workflow, test_repo_hygiene, test_setup_by_hand_commands, test_update_add_codes_documented	300 passed in 40.82s
the gate set: test_validate_workflow_gitmodules_urls, test_scaffold_e2e, test_template_values_single_pass, test_template_quoted_values, test_readme_sections, test_setup_by_hand_commands, test_readme_windows_quoting_sentence, test_update_add_codes_documented	787 passed, 27 skipped in 65.12s (the 27 are the #775 skip)
tests/test_siblings_*.py	205 passed in 65.19s
the 15-file set under Tested	1133 passed, 27 skipped in 224.32s (0:03:44)
scripts/render-cli-reference.py --check	[ok] docs/cli.md is what the generator produces
git diff --check origin/main...HEAD	clean

Main since the round. Main is now 677f9bfa. Its two new commits, #852 and #808, change .github/workflows/ and tests, and none of this PR's 8 files. git merge-tree with the head is clean, giving tree 42f4d9ff. On that tree, test_readme_windows_quoting_sentence, test_release_workflow, test_repo_hygiene, test_readme_sections and test_validate_workflow_gitmodules_urls give 644 passed, 27 skipped in 47.88s.

Tested

RULES has one row per rule (28 rows), each a .gitmodules text (or none), the paths git submodule init is asked about, and the urls git registers for it:

• a url key outside a submodule section ([remote "origin"], [-x], a bare [submodule]), an empty section name, names holding a .. component (../a, a/../b, ..\c, .., a/.., with a..b read), a url beginning with -, a path beginning with -, each given twice with the later beginning with -, a section with no path, no .gitmodules at all, a .gitmodules left unmerged in the index;
• refusals: a file git cannot parse; a path, url, ignore, update and branch with no value; an update of bogus and of !echo hi, and one in a section named p%q and one named with a carriage return; a shallow of maybe; a fetchRecurseSubmodules of sometimes and of On-Demand;
• reads: each update git accepts, each shallow git accepts (true, no, 1, 0x10, empty, bare), each fetchRecurseSubmodules git accepts (on-demand, true, 2, bare), and a bare key in a section git ignores ([submodule ""], [submodule "../x"], [remote "r"], [submodule "..\x"]), which refuses nothing.

Each row is checked three ways:

1. test_git_registers_what_each_row_says: git submodule init -- <path> itself, so a row's expectation is git's.
2. test_siblings_reads_what_each_row_says: siblings.submodule_urls from the template's siblings.py. It skips until shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775's rules (DOTDOT_COMPONENT) are in main, so on this PR's CI it skips; the unmerged row is not asked, since siblings.py reads the file in the working tree. Since the merge round the CR row is asked too. Run against shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775's head 8c5ad0e8 copied over the template (not committed), all 27 pass, so CI, the doctor and git agree on every row it is asked.
3. test_each_step_reads_what_git_reads, test_each_step_exits_as_expected_and_prints_nothing_on_stderr and test_a_file_git_refuses_whole_is_named_with_its_cause_and_its_key: each step's run: body, unmodified, as real bash, in both templates: it names or lists exactly the row's urls, or (the names and fetch steps) exits 1 with an ::error:: naming the cause once, with its key or line, and nothing on stderr. Two more: the fetch step prints no credential advice for a refused file, and prints it before the list otherwise.

Mutants at 31c3792c, each applied at every site, each failing at least 2 of the 420 tests there: the url read without the pattern (10), the path read without it (6), no [ -f ] guard in the names step (2), on-demand compared case-insensitively (12), the refusal's .. test without \ (8), % not escaped (4), a cause that names no key (44), no CR escape in esc (4), no fatal: text in the parse message (4), keys not deduplicated when printed (4), "a ignore" (8), the refusal after the advice (2), no submodule.?*.url filter (6), no .. check (6), no path requirement (12), no unmerged check (6), no parse check (8), no shallow check (12), no fetchRecurseSubmodules check (24).

env PATH="$S/stub:$PATH" GH_TOKEN=bogus GH_CONFIG_DIR="$S/ghcfg" /usr/bin/python3 -m pytest -q -p no:cacheprovider --basetemp=$S/bt -o tmp_path_retention_policy=failed tests/test_validate_workflow_gitmodules_urls.py tests/test_scaffold_e2e.py tests/test_family.py tests/test_template_values_single_pass.py tests/test_repo_hygiene.py tests/test_cli_reference.py tests/test_scaffold_pin_and_reuse.py tests/test_windows_paths.py tests/test_validate_pins_unreadable_workflow.py tests/test_validate_pins_unreadable_workflows_dir.py tests/test_readme_sections.py tests/test_agents_md_codes.py tests/test_readme_windows_quoting_sentence.py tests/test_setup_by_hand_commands.py tests/test_update_add_codes_documented.py
1133 passed, 27 skipped in 224.32s (0:03:44)

(At e91b1a5d; at 31c3792c it was 1115 passed, 26 skipped. $S/stub/gh exits 97. The 27 skipped are the siblings.py rows. The set includes the README line cap and the handbook markers. With #775's siblings.py (8c5ad0e8) in place, tests/test_validate_workflow_gitmodules_urls.py alone is 421 passed in 36.62s.) actionlint 1.7.12 with shellcheck is clean on both templates. The new tests are WINDOWS_SKIP like the ones beside them, since they run the steps as real bash and CI is Linux only; the git submodule init rows run anywhere.

Pinned copies

Both files are pinned template copies, carried by digest (scripts/shape_materialize.py:455 and :539). Each project and each holder that carries the shape sees one upstream-changed row for .github/workflows/validate.yml until it takes the new copy with update-shape.py. #782 changes the same two files, so one row covers both. The two template READMEs are rendered, not pinned.

Not changed, and the edges

• A shallow or fetchRecurseSubmodules at the edge of an integer's range: the runner's git answers, as it does git submodule; the doctor and siblings.py carry git 2.55's range as a table.
• --get -- "$key" is now always given a submodule. key, so its -- guards nothing more; it stays, as validate.yml (assembly-root and family-root templates): each submodule url is read by its exact key, --name-only then --get, so a section named members/My IRRS gives the url git gives, where the split at the first space gave IRRS.url <url>, left that repository out of the App token and listed it wrong in both failure steps (#741) #782 has it.
• An unmerged .gitmodules reads nothing and says nothing; a fresh checkout never has one.
• RV-c's N2 edges, pathological or older than this change: a section whose path is no gitlink, two sections for one path, path = with no value, a \001 in a name, shallow = "\n1", a refused file with no gitlinks.

Overlap

#782, which this was stacked on, and lane 3's #630, which edited README.md and docs/handbook.html, have both landed and are merged in (see the merge round). #775 changes siblings.py and shape-doctor.py, not these files. README.md and docs/handbook.html put this PR in lane 3's README turn.

🤖 Generated with Claude Code

Summary by Sourcery

Make validation workflows derive submodule repositories from Git-readable .gitmodules content and fail clearly when Git rejects the file.

Bug Fixes:

• Make validation workflows report and fail on .gitmodules files that Git refuses to read, including the specific invalid key or parse line, regardless of configured credentials.
• Ensure repository naming and URL reporting follow Git's submodule-reading rules so ignored sections, missing paths, unmerged files, and dash-prefixed values are not included.

Enhancements:

• Align assembly-root and family-root validation workflow handling with the repository doctor and sibling discovery rules.
• Expand workflow coverage for valid, ignored, malformed, refused, and edge-case .gitmodules configurations across both templates.

Documentation:

• Document that Git-refused .gitmodules files fail validation independently of credential configuration.

Tests:

• Add comprehensive tests comparing workflow results with Git's registered submodule URLs and refusal behavior.

[sourcery-ai]

Reviewer's Guide

Updates both validation workflow templates so all three .gitmodules URL-reading sites consistently mirror Git’s parsing and filtering behavior, fail clearly on files Git refuses, and avoid unsafe or nonexistent repositories; adds extensive cross-template tests covering extraction, refusals, deduplication, and shell behavior.

Sequence diagram for validated gitmodules repository discovery

sequenceDiagram
    participant Workflow as Validate workflow
    participant Gitmodules as .gitmodules
    participant Git as Git config
    participant Output as Token or URL list
    Workflow->>Git: ls-files -u -- .gitmodules
    alt file is unmerged
        Git-->>Workflow: conflict entries
        Workflow-->>Output: name nothing
    else file is resolved
        Workflow->>Git: config --file .gitmodules --list
        alt Git refuses the file
            Git-->>Workflow: refusal cause
            Workflow-->>Output: ::error:: and exit 1
        else file is readable
            Workflow->>Git: config --name-only --get-regexp \.url$
            loop each candidate key
                Workflow->>Git: config --get -- submodule.name.url
                Workflow->>Git: config --get -- submodule.name.path
                Workflow->>Workflow: apply submodule, name, path, URL, and line-break rules
            end
            Workflow->>Output: emit deduplicated valid repositories
        end
    end

Loading

Flow diagram for gitmodules refusal and URL filtering

flowchart TD
    A[Read .gitmodules] --> B{Unmerged index?}
    B -->|Yes| C[Read nothing]
    B -->|No| D{Git accepts whole file?}
    D -->|No| E[Print refusal cause and exit 1]
    D -->|Yes| F[Enumerate exact URL keys]
    F --> G{Valid submodule name?}
    G -->|No| F
    G -->|Yes| H{Has valid path and URL?}
    H -->|No| F
    H -->|Yes| I{URL already emitted?}
    I -->|Yes| F
    I -->|No| J[Add repository to token or diagnostic list]
    J --> F

Loading

File-Level Changes

Change	Details	Files
Align all .gitmodules URL extraction with Git’s effective parsing rules across the token-name, fetch-warning, and failure-reporting workflow steps.	Replace first-space parsing with --name-only plus per-key --get reads. Ignore non-submodule keys, unsafe section names, missing or dash-prefixed paths/URLs, unmerged files, and newline/CR URLs. Deduplicate repositories when constructing App token inputs. Apply the same filtering logic to both assembly-root and family-root templates.	templates/assembly-root/.github/workflows/validate.yml templates/family-root/.github/workflows/validate.yml
Detect .gitmodules files that Git rejects entirely and fail workflow steps with a diagnostic cause before naming or listing repositories.	Validate parseability and scan NUL-delimited Git config records for invalid or valueless submodule settings. Validate supported update, shallow, and fetchRecurseSubmodules values using Git’s own config parser. Make refused files fail the fetch path even when credential-related failures previously degraded to success.	templates/assembly-root/.github/workflows/validate.yml templates/family-root/.github/workflows/validate.yml
Add comprehensive behavioral tests comparing both templates’ shell steps against Git’s submodule interpretation.	Exercise valid, ignored, unsafe, duplicate, unmerged, malformed, and refusal cases. Run unmodified workflow step bodies under Bash and verify outputs, exit status, stderr, and refusal diagnostics. Cross-check expected registrations with git submodule init and, when available, siblings.py.	tests/test_validate_workflow_gitmodules_urls.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#786	Make both validate.yml templates include only repositories Git recognizes from .gitmodules, excluding ignored section types, empty or invalid names, sections without a path, and paths or URLs beginning with a dash.	✅
#786	Have all three URL-reading steps in both templates read nothing from an unmerged .gitmodules and fail clearly when Git would refuse the file, including the specified invalid key values.	✅
#786	Add tests for both templates that compare their behavior across the three steps with Git’s submodule behavior for the relevant .gitmodules rules.	✅

Possibly linked issues

• validate.yml templates (assembly root and family root): CI still reads .gitmodules sections git ignores ([submodule ""], a .. name, a url with no path, a non-submodule section, a file git refuses), so the App token and the lists name repositories git never fetches #786: The PR implements the issue’s requested Git-compatible filtering and whole-file refusal behavior at all three URL-reading steps in both templates.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

(lane openRepoShape-3, 2026-10-17T09:36:50Z) Independent review of #790 by RV-c (opus), on head 85754e2f (stacked on #782): NOT READY. No MUST; three SHOULDs, each small. On all 21 RULES rows, CI agrees with git, the doctor and siblings.py (#775 at 3fa5beed), in both templates and all three steps. Rendering is byte-identical, actionlint is clean, and the merges are clean.

SHOULD 1: a later - value drops a section that git, the doctor and siblings all read.

• Where: the url= and mount= reads, assembly :126-127, :273-274, :362-363 and family :122-123, :274-275, :356-357.
• Scenario: url = <A> then url = -x. git registers A, ignoring -x alone, and the doctor and siblings give A. CI names only the other sections, so A leaves the App token and both failure lists. A path given twice splits the same way.
• The PR's reason does not hold: --get takes a value pattern and still returns one whole value:

values	result
[A, -x]	A
[A, B]	B
[-x]	rc=1
[-x, A]	A
[A, "B\n::error::x"]	the whole second value, which the line-break skip then drops

• Fix: at all 12 reads, use --get -- "$key" '^([^-]|$)' and --get -- "submodule.$name.path" '^([^-]|$)'. Reword the step comment, and add both cases as rows.
• Tried in scratch: actionlint 0, 0 disagreements, 360 passed.

SHOULD 2: the project cannot see which line or key to fix.

• Unparsable file: validate.yml (assembly-root and family-root templates): each submodule url is read by its exact key, --name-only then --get, so a section named members/My IRRS gives the url git gives, where the split at the first space gave IRRS.url <url>, left that repository out of the App token and listed it wrong in both failure steps (#741) #782's names step showed fatal: bad config line 5 in file .gitmodules. validate.yml (assembly-root and family-root templates): the three url-reading steps read .gitmodules by the rules the doctor and siblings.py read it by, so a section git ignores, a section with no path, a path or url beginning with -, an unmerged file or a file git refuses whole no longer puts a repository in the App token or the lists, and a refused file fails the step with its cause (#786) #790's prints only "git cannot parse .gitmodules …", with stderr sent to /dev/null (assembly :92, :239, :328; family :88, :240, :322).
• Bare url: it prints only "holds a url key with no value".
• With the App configured, the job stops there, and nothing in the log names the section or the line. Without it, git's own lines show only after advice to configure an App, which is the wrong advice here.
• Wording: "a ignore key" and "a update key". The parse case's sentence also differs from the body's .gitmodules holds <cause> form.
• Fix:
  1. Capture git's error (if ! err=$(git config --file .gitmodules --list 2>&1 >/dev/null)) and put its fatal: text in the message.
  2. Name the key in each cause, escaped as workflow-command data (%→%25, CR→%0D), or at least add "git submodule status names the key and line git stops at". RV-c measured that it does for every cause.
  3. Fix the grammar.
  4. In the fetch step, refuse before the App warning (assembly :236, family :237).
  5. Have the cause test assert the key or the line.

SHOULD 3: red is right, but the docs say otherwise. No credential can cure a file git refuses. These still say a run "fails outright only if a credential is configured":

• README.md:659-666 and docs/handbook.html:1139-1142;
• the fail-step comments, assembly :313-321 and family :310-315;
• templates/family-root/README.md:139-140 ("it still runs the checks that do not need the members").

Add one clause to each, saying a .gitmodules git refuses fails the run whatever the credential. README and handbook change together, which puts this PR in lane 3's README turn.

Optionally, record the refusal as a fetch-step output and fail in a final step, so the checks that need no legs still run. The mint must stay skipped then: an empty repositories: mints a token for the whole installation.

Items 3 and 4 are fine. The runner's own git answers both the range check and the fetch. A CI checkout never has an unmerged index.

NITs:

• N1: 7 of 13 mutants survive. Three change behaviour on real files:
  • No [ -f .gitmodules ] guard in the names step: an App-configured project with no .gitmodules goes red. Add a row.
  • on-demand compared case-insensitively: git dies on On-Demand. Add a refusal row.
  • The refusal loop's .. test without \: a bare ignore in [submodule "..\x"] refuses the whole file though git reads the rest. Add a row.
• N2: CI-vs-git edges, each pre-existing or pathological:
  • a section whose path is no gitlink (git rm --cached);
  • two sections for one path;
  • path = with no value;
  • a \x01 name with a bare url;
  • shallow = "\n1";
  • a refused file with no gitlinks.
• N3: the fail step's refusal block (assembly :326-357, family :320-351) can never fire, because the fetch step has already exited 1.
• N4 (body): the warning prints before the refusal, and the parse case's message differs from the body's description.

Outside this PR: siblings.py (main and 3fa5beed, :292-304) splits --list output at the first =, so it drops [submodule "a=b"], which git, the doctor and CI all read. Lane 3 files it.

Runs:

• the targeted set: 943 passed, 20 skipped;
• main + shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775 + validate.yml (assembly-root and family-root templates): the three url-reading steps read .gitmodules by the rules the doctor and siblings.py read it by, so a section git ignores, a section with no path, a path or url beginning with -, an unmerged file or a file git refuses whole no longer puts a repository in the App token or the lists, and a refused file fails the step with its cause (#786) #790, the new file alone: 379 passed, with the siblings rows running;
• the render probe: byte-identical;
• actionlint with shellcheck: 0.

Merges: clean with main, with main + #775, and with every other open lane-3 PR except #791, whose conflict is with main itself.

Lane: openreposhape-3 (openRepoShape-3)

[brettheap]

(lane openRepoShape-3, 2026-10-17T10:12:50Z) Re-verification of #790 round 2 by RV-c (opus), on head 24df81cb (a fast-forward of 85754e2f): READY. No MUST, no SHOULD, three NITs. All three round-1 SHOULDs are fixed, each measured.

Agreement: all 27 rows agree in both templates and every step that can see them (54 of 54). The names and fetch steps agree with git submodule init, the doctor and siblings.py (#775 at 3fa5beed). The fail step agrees on every row that reaches it.

Checked:

• S1: all 12 reads take '^([^-]|$)'. On both new rows, git, the doctor, siblings and CI all give the earlier value. Dropping the pattern is caught at all 6 sites of each read.
• S2:
  • The parse case prints (bad config line 5 in file .gitmodules).
  • Each cause names its key, for example (submodule.q.url); % prints as %25 and a CR as %0D.
  • The grammar is fixed, and the refusal comes before the App advice (tested).
  • LF needs no escape: git refuses a literal LF in a section name, a quoted \n reads as n, and the cause texts are fixed single lines. So esc is complete.
• S3: all seven places are true in both templates. The README cap ledger (tests/readme-cap.d/786.txt, +1) and the recomputed handbook markers pass.
• N1: the three new rows kill round 1's three meaningful survivors.
• N3: the skip is honest.
  • A failed submodule update makes the fetch step run the same check and exit 1, which skips the fail step.
  • A successful one sets legs_available=true.
• N4: the body matches the code.
• The unrequested awk '!seen[$0]++' dedupe:
  • It never hides a different section, since two sections always have different keys.
  • It matches git's set: a reopened a, plus b, plus [submodule "A"] lists A, B, C, as git does.
  • Without it, the "url given twice" row fails.

NITs:

1. The CR escape has no test.
   • Removing -e "s/$(printf '\r')/%0D/g" from esc (A :96, :250; F :92, :251) survives, and the names step then prints a raw CR in its ::error:: line (measured).
   • Add a refusing row whose section name holds a CR, with a plain path: section("q\rx", "path = q", …, "update = bogus"), expecting submodule.q%0Dx.update.
2. Three harmless survivors remain: no break after the first cause, and splitting at the last \001 instead of the first. They matter only for a file with two causes or a value holding a newline.
3. Out-of-scope edges remain, as measured: empty path =, a path that is not a gitlink, two sections giving one path, \x01 in a name with a bare url, and shallow = "\n1". One more matters for the docs: a refused file with NO gitlinks. git exits 0 there, so with no App the run is green, and the new sentence "fails the run whatever the credential" overstates.

For lane 4's #690: siblings.py also splits a CR in a section name (splitlines() without -z). The -z read fixes this too; it is noted on #690.

Runs:

• the 15-file set: 1102 passed, 26 skipped;
• main + shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775 + validate.yml (assembly-root and family-root templates): the three url-reading steps read .gitmodules by the rules the doctor and siblings.py read it by, so a section git ignores, a section with no path, a path or url beginning with -, an unmerged file or a file git refuses whole no longer puts a repository in the App token or the lists, and a refused file fails the step with its cause (#786) #790 predicted (tree 3ead8d06): 407 passed, and 483 passed with test_readme_sections.py;
• the render probe: byte-identical (A 58726aab…, F 4a85add5…);
• actionlint with shellcheck: 0;
• mutants: 16 of 20 killed (the survivors are NITs 1 and 2).

Merges:

• Clean with main, with main + shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775, and with 34 of the other 35 open PRs.
• #630 conflicts in docs/handbook.html on the three "§ The three legs" blob markers. Whichever lands second recomputes them, in lane 3's README turn.

Lane: openreposhape-3 (openRepoShape-3)

[brettheap]

(lane openRepoShape-3, 2026-10-17T10:18:56Z) #790's NIT round, 24df81cb..31c3792c: NIT 1 is closed, and RV-c's READY stands. Lane 3 checked it directly; it is a test-only round.

• The round: a plain fast-forward that changes only tests/test_validate_workflow_gitmodules_urls.py (+17/−7). The templates and docs are untouched.
• NIT 1, the CR row: it is the section q\rx with path = q and update = bogus, and expects submodule.q%0Dx.update. Removing the CR escape from esc at its four sites now fails 4 tests (4 failed, 390 passed).
• NIT 3, the docs edge: a refused file that mounts no leg exits 0 in git submodule update, measured. The body now states this edge; the eight doc places are unchanged.
• W741's runs: the 15-file set gives 1115 passed, 26 skipped; with shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775's siblings.py, 420 passed. actionlint 0.
• To fix when validate.yml (assembly-root and family-root templates): the three url-reading steps read .gitmodules by the rules the doctor and siblings.py read it by, so a section git ignores, a section with no path, a path or url beginning with -, an unmerged file or a file git refuses whole no longer puts a repository in the App token or the lists, and a refused file fails the step with its cause (#786) #790 lands: test_siblings_reads_what_each_row_says skips the CR row, because siblings.py splits --list at splitlines.
  • The docstring says the defect is one "which lane 3 files". Lane 3 handed it to lane 4 instead (siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690, issuecomment-6232689453); siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690's -z read fixes both it and the = split.
  • If siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690 has landed by then, drop the skip and that clause. If not, point the clause at siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690.

Lane: openreposhape-3 (openRepoShape-3)

[brettheap]

(lane openRepoShape-3, 2026-10-18T00:08:49Z) RV790n's re-check of #790's merge round (31c3792c..e91b1a5d): READY. No MUST and no SHOULD. Its one NIT is the PR body's stale main and README figures, which the squash message does not use. Every merge is exact and the round changed no template byte. All 23 handbook markers are current, CI is green on e91b1a5d, and the predicted squash over e62b5e17 passes the docs, gitmodules and siblings tests.

RV790m, the first re-checker, stalled before it measured anything. RV790n started fresh and used none of its files.

---

RV790n re-check of #790 (#786) at head e91b1a5d

RV790n verdict: READY for the merge round 31c3792c..e91b1a5d. No MUST, no SHOULD, one NIT. The PR head is still e91b1a5dba55ca090b03dd3568f4a5efa71b2bf8 and origin/main is still e62b5e1734405efb71ac78075d16c6ff9acbb5ad; I re-fetched at 00:03Z and neither moved. I made no GitHub write. I did not read or reuse anything under RV790m.

Checks

1. Each merge is exact. I recomputed each with git merge-tree --write-tree, applied the stated resolution in a scratch detached worktree, and compared trees with git rev-parse <commit>^{tree}.

Commit	Parents	Result
564898ed	31c3792c + a59cb537	merge-tree conflicts only in docs/handbook.html, 3 hunks, each the § The three legs marker (lines 477, 1133, 1200 of the conflicted blob, a1299381 against 1d9f5bf9). I set all three to 4ec313e8424665e41fc92a4147808e0bd4901d78. The resolved tree is 9f07f48f78d4ae4cb924b24b32da7fb482a9c58b, equal to the commit's tree.
47b9d5fc	564898ed + a9d15797	merge-tree conflicts in both validate.yml templates and tests/test_validate_workflow_gitmodules_urls.py (add/add). With git checkout --ours on those 3 files the tree is 9f07f48f78d4ae4cb924b24b32da7fb482a9c58b, equal to the commit's tree.
17cf189a	47b9d5fc + 2e476a77	merge-tree is clean, tree 1d73091f410f9281c43a39820db19f11a867e2b2, equal to the commit's tree. It touches install.sh, openRepoShape, tests/test_install_sh.py and tests/test_openreposhape_command.py, none of the PR's 8 files.
e91b1a5d	17cf189a	one file, tests/test_validate_workflow_gitmodules_urls.py (+5/−6): it drops and "\r" not in (rule.gitmodules or "") and rewords the docstring. git diff --check is clean.

• a59cb537 and a9d15797 have the same tree, 42beda6c.
• The docstring's "since siblings.py: the printed move runs as typed past a taken staging name and names a dangling link to move aside first, a NUL or lone surrogate in project: or url is a finding, .gitmodules is read as git reads it, the warning's prose is spelled, and a tag-only branch is named (#690) #805 (siblings.py (make siblings): the printed mv goes astray over an existing .holder/.folder or a dangling link, a lone surrogate or NUL in project: is a traceback, a url with NEL or U+2028 is cut, two warnings print paths raw #690)" is right: 40e678e6 is (#690) (#805) and is in 2e476a77.

2. Step 2 changed nothing. git diff 564898ed 47b9d5fc on the 3 files is empty, and so is the whole-tree diff. The blobs are identical: assembly 731464c0, family 5da6fc2c, test 138abadd.

3. The PR carries only its own change.

• Against 2e476a77, the main the PR merged, git diff --name-only 2e476a77 e91b1a5d lists exactly the 8 files: README.md, docs/handbook.html, both validate.yml templates, both template READMEs, tests/readme-cap.d/786.txt and the test file. git diff --name-only origin/main...e91b1a5d gives the same 8.
• The literal git diff --name-only origin/main e91b1a5d now lists 49 files, because main moved (tests.yml and release.yml: a push to a release/v<major>.<minor> branch that holds this change runs the suite as a push to main does, so a patch's commit there gets its push run with no dispatch, a fast-forward of that branch to main's commit no longer cancels main's run on it, and the release header says how a fix is back-ported (#850) #852, tests/: the quoting-sentence inventory sees a quoter handed on as a value and pins each function's host-dialect calls, and the launcher guard reads run_child and run([PYTHON, ...]), with rows for cli.py and setup-project.py (#759) #808, shape-doctor.py: a conflicted shape pin's NEXT takes the side whose pin reads, and names no line where no side's pin reads, so run as printed it no longer leaves the doctor naming the same NEXT again (#752) #779, family.py: add, bump and remove refuse a cherry-pick or a revert stopped in a holder whose refs are a reftable, asking its ref store for CHERRY_PICK_HEAD and REVERT_HEAD by their exact names where no file holds them (#684) #846, tests/test_doctor_legs_members_next.py and 24 other files: tests append what they tell git to the GIT_CONFIG_COUNT entries the environment holds, so a pasted line keeps the session's maintenance settings and the Windows job's two (#758) #818, siblings.py: a file, or a folder make siblings cannot list or enter, at ../<Project> is NOT A CLONE, reported and left as it is, so the run no longer ends in a traceback at iterdir before the members after it are placed, and make park no longer ends in one over a folder it cannot enter (#735) #772, README.md, the handbook, AGENTS.md and the family-root docs: init's --into sentence names the family-landing-in-standard refusal, make siblings is described as it stops before cloning, and members/ has its one-spelling rule (#695) #738). That is a main-moved effect, not a PR change.
• I compared the -U0 changed lines, parsed by hunk with the marker lines removed: 679 lines for git diff 67324e91 31c3792c and 678 for git diff 2e476a77 e91b1a5d. The only difference is step 4's edit, at the if not rule.unmerged line and the docstring. The writer's 676 is my 679 minus 3 handbook prose lines.
• validate.yml (assembly-root and family-root templates): each submodule url is read by its exact key, --name-only then --get, so a section named members/My IRRS gives the url git gives, where the split at the first space gave IRRS.url <url>, left that repository out of the App token and listed it wrong in both failure steps (#741) #782's content (67324e91, a59cb537, 2e476a77, main) is the same blob for all 3 files. The templates at 31c3792c and e91b1a5d are identical blobs, so the round changed no template byte.

4. Markers. I ran the head's tests/test_repo_hygiene.py helpers on a detached worktree of e91b1a5d:

• handbook_marker_problems and handbook_footer_problems both return [].
• _handbook_markers finds 23 markers, none stale.
• The three The three legs markers (lines 477, 1129, 1192) all read 4ec313e8…. readme_fingerprint and git hash-object --no-filters agree on that blob.
• README is 1475 lines (splitlines) at a cap of 1422 + 2 + 5 + 12 + 22 + 10 + 1 + 1 = 1475.
• Mutants: setting the first marker back to 1d9f5bf9 or to a1299381 each fails tests/test_repo_hygiene.py::test_the_handbook_follows_the_readmes_outline (1 failed, 153 passed).

5. The CR row ("an update in a section named with a carriage return").

• On git 2.43.0, git config -z -f .gitmodules --list keeps the CR inside the key as submodule.q<CR>x.update. git submodule init -- q and -- ok both say fatal: invalid value for 'submodule.q?x.update', so git refuses the whole file and the row's "no urls" is right.
• Under shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775's siblings.py (origin/l3-733-ignored-sections, 8c5ad0e8, blob 149c752a) laid over a worktree of e91b1a5d:
  • tests/test_validate_workflow_gitmodules_urls.py gives 421 passed in 47.48s.
  • test_siblings_reads_what_each_row_says alone gives 27 passed, and [an update in a section named with a carriage return] PASSED.
• I also laid the siblings.py of the merge-tree of current origin/main with shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775 over a worktree of the predicted squash. shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775 merges cleanly with current main, tree eeab8e9b. The result is 421 passed in 35.56s.
• On main's own siblings.py the 27 rows skip, and nothing fails: 394 passed, 27 skipped.
• The skip is needed. With it removed on main's siblings.py, 19 of 27 rows fail, including the CR row (['https://github.com/acme/Ok.git', …Q.git'] == []).
• Mutant: reverting siblings.py to --list with splitlines and partition("="), over main plus shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775, fails only the CR row (1 failed, 26 passed). So dropping the exclusion is right, and the row is the one test that catches a return to the splitlines read.
• Windows: holder_of writes .gitmodules with write_bytes, so nothing rewrites the CR. No change is needed.

6. Tests on e91b1a5d, under a stub gh that exits 97, with GH_TOKEN=bogus and an empty GH_CONFIG_DIR, targeted files only:

• The 8 docs files: 300 passed in 41.87s.
• tests/test_validate_workflow_gitmodules_urls.py: 394 passed, 27 skipped in 37.57s. The 27 are the shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775 skip.
• tests/test_siblings_*.py (2 files): 205 passed in 65.94s (0:01:05).
• All 8 docs files exist at both commits. I did not run tests/test_shape_doctor.py.

7. Merge with current origin/main. git merge-tree --write-tree origin/main e91b1a5d is clean.

• The predicted squash tree is 1f69f54392c1f1f926ecc0dd8db16b254d1e3a93, over main e62b5e1734405efb71ac78075d16c6ff9acbb5ad.
• The scratch commit is 947805a4095e04df486f5affa5ebd8bb85c8d3f0, never pushed. Its diff against main is exactly the 8 files (+613/−71).
• The same merge with 677f9bfa gives 42f4d9ff, as the PR body says.

On a detached worktree of 947805a4:

• The marker check returns [] for markers and footer. There are 23 markers, none stale, all three legs markers are 4ec313e8…, and the cap ledger has no problems. README is 1474 lines against a cap of 1475, because README.md, the handbook, AGENTS.md and the family-root docs: init's --into sentence names the family-landing-in-standard refusal, make siblings is described as it stops before cloning, and members/ has its one-spelling rule (#695) #738 took a line off.
• The 8 docs files: 331 passed in 43.08s.
• tests/test_validate_workflow_gitmodules_urls.py: 394 passed, 27 skipped in 33.63s.
• tests/test_siblings_*.py: 205 passed in 65.83s (0:01:05).

gh pr checks 790 (read-only)

Check	Result	Link
SonarCloud Code Analysis	pass, 19s	https://sonarcloud.io/dashboard?id=opensoft_openRepoShape&pullRequest=790
package	pass, 27s	https://github.com/opensoft/openRepoShape/actions/runs/39075735812/job/117522383531
tests	pass, 53m48s	https://github.com/opensoft/openRepoShape/actions/runs/39075735812/job/117522383739
tests-git-bash	pass, 2m9s	https://github.com/opensoft/openRepoShape/actions/runs/39075735812/job/117522383740

Run 39075735812 has headSha e91b1a5dba55ca090b03dd3568f4a5efa71b2bf8. The Sonar comment reports 0 new issues and 0.0% new duplication.

Items

• NIT (PR body): it is stale on two points. "Main is now 677f9bfa" is now e62b5e17. "README.md is 1475 lines, at a cap of 1475" holds at the head, but a squash over current main is 1474 of 1475, because README.md, the handbook, AGENTS.md and the family-root docs: init's --into sentence names the family-landing-in-standard refusal, make siblings is described as it stops before cloning, and members/ has its one-spelling rule (#695) #738 took a line off. Neither affects landing. If the body is edited, add "tree 1f69f543 over e62b5e17".
• Docs for the changed behaviour: the README paragraph, the handbook list item and both template READMEs each say "whatever the credential" next to the unchanged "fails outright only if a credential is configured". The pair reads true, and the earlier reviews cover it.
• Scope: I did not re-review the template logic. Both validate.yml blobs at e91b1a5d equal 31c3792c, which RV-c reviewed READY at 24df81cb, and the round only touched the test.

Scratch paths (clone and scratch root; -wt-m1 and -wt-m2 hold uncommitted in-progress merges)

• /workspace/projects/openRepoShape-worktrees/_lane3-scratch/RV790n
• /workspace/projects/openRepoShape-worktrees/_lane3-scratch/RV790n-scratch/
  • worktrees: RV790n-wt-m1, RV790n-wt-m2, RV790n-wt-head, RV790n-wt-775, RV790n-wt-noskip (skip-removed mutant, markers reverted), RV790n-wt-pred (the 947805a4 squash), RV790n-wt-pred775 (squash plus main+shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775 siblings.py, then mutant A applied)
  • probes: RV790n-markers.py, RV790n-markers2.py, RV790n-chg.py, RV790n-resolve1.py
  • other files: RV790n-pred-commit.txt, RV790n-own2.txt, RV790n-head2.txt, RV790n-stub/gh, RV790n-ghcfg/, bt-* basetemps

Lane: openreposhape-3 (openRepoShape-3)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 28 minutes by commenting @sourcery-ai review. Upgrade to get a review now.