fix(lint): five false positives that made users disable bashrs lint (GH-217, GH-209)

[noahgift]

Closes #217. Closes #209.

Both issues have the same ending: a user turned bashrs lint off. #217 blocked commits via forjar's pre-commit hook; #209's reporter dropped the bashrs lint Makefile step from CI entirely after no combination of suggested fixes could make a correct Makefile exit 0.

A rule that cannot be satisfied doesn't get fixed — it gets removed.

---

GH-217 — quoted heredoc bodies are not shell

python3 - <<'PY'
p = 1
q = 2
PY

bash -n accepts this. Published 6.66.2 reports 2 × SC1007 — Severity::Error, so it blocks commits.

Root cause is one level above the symptom. The rules see a flat stream of physical lines with no notion of heredoc regions, so any line-oriented rule fires inside these bodies. SC1007 is just the one that got hit. (#211 was the same shape: sc2188 iterating physical instead of logical lines.)

The machinery already existed and wasn't shared — sc2006 carried a private get_quoted_heredoc_lines from issue #96; the other 384 rules had nothing. A per-rule fix can't generalise, so this is applied once, where diagnostics are aggregated. Every current and future rule inherits it. sc2006's copy is deleted, so there's one definition instead of two that can drift.

Written as a state machine, not the regex-per-line approach sc2006 used: scanning every line for openers also matches openers inside a body (a heredoc documenting a heredoc), silently extending the suppressed region past its end. There's a test for exactly that.

Unquoted heredocs are deliberately still linted — their bodies undergo expansion, so they really are shell.

---

GH-209 — four Makefile defects

1. --fail-on was ignored for the common invocation. Single-file lint routed to output_lint_results, which picked the exit code itself (has_warnings → exit 1) and never saw opts.fail_on. The flag worked only under --ci. That function is removed rather than taught about the flag, so no caller can reintroduce an exit decision that bypasses the threshold. Default stays Warning; out-of-the-box exit codes are unchanged.

2. MAKE003 read $$ as a variable. $$ is Make's escape for a literal $. The parser fell into its $VAR branch, matched zero characters, and emitted a one-character diagnostic whose autofix was "$". The trigger is the self-documenting-help idiom in most Makefiles, where $$1/$$2 are awk field references — quoting them breaks the awk program.

3. MAKE010 missed compound error handlers. has_error_handling was a substring test for the literal "|| exit", so curl … || { echo "✗ failed"; exit 1; } read as unhandled — though it's better than a bare || exit 1. The autofix appended a second || exit 1 after a block that already exits.

4. MAKE016's autofix broke the build. It flagged $(VAR) in prerequisites and offered to quote it. GNU Make does no quote removal in prerequisite lists, so sakila: "$(DIR)"/x.sql asks for a file whose name literally starts with " — and the build then fails pointing at the prerequisite, not at the linter that wrote it. The rule's own doc-comment carried the broken form as its ✅ GOOD example, so the premise was wrong from the first commit. There is no correct version of "quote this prerequisite" — recipes are shell, prerequisites are not — so it's retired to a total no-op, ID still registered so existing --ignore MAKE016 configs keep parsing.

---

Verification

RED, published 6.66.2 binary	2 × SC1007 on valid shell
Targeted tests	45 passed, 0 failed (heredoc + make003/010/016 + existing property tests)
Full suite	14,596 passed, 0 failed

The full suite is the one that mattered: a filter at the aggregation layer could have silently suppressed diagnostics hundreds of tests depend on. It didn't.

Every fix is paired with a test asserting the true positive still fires, so none of these trades a false positive for a false negative.

Two self-inflicted bugs caught before shipping, both worth noting:

• || { fail "x"; } failed my own MAKE010 fix — { tokenises separately, so stripping the brace from the first word left an empty string.
• My first MAKE003 test was vacuous: $$1 inside the awk single-quotes is already skipped by pre-existing quote tracking, so it would have passed with or without the fix. Moved outside quotes so it discriminates.

🤖 Generated with Claude Code