fix: shellcheck TODO has no enforcement — || true may never be removed (#71)

- Fix SC2164: add || exit 1 to bare cd in update-prompt.sh
- Fix SC2155: separate declare and assign in env.sh, supervisor-poll.sh, dev-agent.sh
- Fix SC2034: inline suppression for vars used by sourced helpers
- Remove unused `mergeable` declaration, rename unused loop var to `_w`
- Remove || true from shellcheck CI step — failures are now blocking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker/ci.yml

@@ -12,9 +12,7 @@ steps:
   - name: shellcheck
     image: koalaman/shellcheck-alpine:stable
     commands:
-      # Report warnings but don't block CI — existing code has known issues
+      - find . -name "*.sh" -not -path "./.git/*" -print0 | xargs -0 -r shellcheck --severity=warning
-      # TODO: fix all warnings (#45) and remove || true
-      - find . -name "*.sh" -not -path "./.git/*" -print0 | xargs -0 -r shellcheck --severity=warning || true
 
   - name: duplicate-detection
     image: python:3-alpine

dev/dev-agent.sh

@@ -28,7 +28,9 @@ git -C "$FACTORY_ROOT" pull --ff-only origin main 2>/dev/null || true
 
 # --- Config ---
 ISSUE="${1:?Usage: dev-agent.sh <issue-number>}"
+# shellcheck disable=SC2034
 REPO="${CODEBERG_REPO}"
+# shellcheck disable=SC2034
 REPO_ROOT="${PROJECT_REPO_ROOT}"
 
 API="${CODEBERG_API}"
@@ -143,7 +145,8 @@ post_refusal_comment() {
     log "skipping duplicate refusal comment: ${title}"
     return 0
   fi
-  local comment="${emoji} **Dev-agent: ${title}**
+  local comment
+  comment="${emoji} **Dev-agent: ${title}**
 
 ${body}
 

dev/dev-poll.sh

@@ -83,6 +83,7 @@ sys.exit(1)
 " 2>/dev/null && return 0 || return 1
 }
 
+# shellcheck disable=SC2034
 REPO="${CODEBERG_REPO}"
 
 API="${CODEBERG_API}"
@@ -98,7 +99,7 @@ log() {
 # HELPER: try merge, rebase if mergeable=false, then retry once
 try_merge_or_rebase() {
   local pr_num="$1" issue_num="$2" branch="$3"
-  local merge_code mergeable
+  local merge_code
 
   merge_code=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
     -H "Authorization: token ${CODEBERG_TOKEN}" \
@@ -472,7 +473,7 @@ nohup "${SCRIPT_DIR}/dev-agent.sh" "$READY_ISSUE" >> "$LOGFILE" 2>&1 &
 AGENT_PID=$!
 
 # Wait briefly for preflight (agent writes result before claiming)
-for w in $(seq 1 30); do
+for _w in $(seq 1 30); do
   if [ -f "$PREFLIGHT_RESULT" ]; then
     break
   fi

lib/env.sh

@@ -82,7 +82,8 @@ matrix_send() {
   [ -z "${MATRIX_TOKEN:-}" ] && return 0
   local prefix="$1" msg="$2" thread_id="${3:-}" ctx_tag="${4:-}"
   local room_encoded="${MATRIX_ROOM_ID//!/%21}"
-  local txn="$(date +%s%N)$$"
+  local txn
+  txn="$(date +%s%N)$$"
   local body
   if [ -n "$thread_id" ]; then
     body=$(jq -nc --arg m "[${prefix}] ${msg}" --arg t "$thread_id" \

lib/matrix_listener.sh

@@ -34,6 +34,7 @@ if [ -z "${MATRIX_TOKEN:-}" ] || [ -z "${MATRIX_ROOM_ID:-}" ]; then
 fi
 
 # URL-encode room ID
+# shellcheck disable=SC2034
 ROOM_ENCODED="${MATRIX_ROOM_ID//!/%21}"
 
 # Build sync filter — only our room, only messages
@@ -108,6 +109,7 @@ while true; do
   while IFS= read -r event; do
     SENDER=$(printf '%s' "$event" | jq -r '.sender')
     BODY=$(printf '%s' "$event" | jq -r '.content.body // ""')
+    # shellcheck disable=SC2034
     EVENT_ID=$(printf '%s' "$event" | jq -r '.event_id')
 
     # Check if this is a thread reply

review/review-poll.sh

@@ -12,7 +12,9 @@ export PROJECT_TOML="${1:-}"
 source "$(dirname "$0")/../lib/env.sh"
 
 
+# shellcheck disable=SC2034
 REPO="${CODEBERG_REPO}"
+# shellcheck disable=SC2034
 REPO_ROOT="${PROJECT_REPO_ROOT}"
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 

review/review-pr.sh

@@ -29,7 +29,9 @@ git -C "$FACTORY_ROOT" pull --ff-only origin main 2>/dev/null || true
 
 PR_NUMBER="${1:?Usage: review-pr.sh <pr-number> [--force]}"
 FORCE="${2:-}"
+# shellcheck disable=SC2034
 REPO="${CODEBERG_REPO}"
+# shellcheck disable=SC2034
 REPO_ROOT="${PROJECT_REPO_ROOT}"
 
 # Bot account for posting reviews (separate user required for branch protection approvals)

supervisor/supervisor-poll.sh

@@ -511,6 +511,7 @@ check_project() {
       BODY=$(echo "$BACKLOG_FOR_DEPS" | jq -r ".[$i].body // \"\"")
       ISSUE_DEPS=$(echo "$BODY" | bash "$PARSE_DEPS" | grep -v "^${NUM}$" || true)
       [ -n "$ISSUE_DEPS" ] && DEPS_OF[$NUM]="$ISSUE_DEPS"
+      # shellcheck disable=SC2034
       BACKLOG_NUMS[$NUM]=1
     done
 
@@ -526,7 +527,8 @@ check_project() {
       for dep in ${DEPS_OF[$node]:-}; do
         [ -z "${NODE_COLOR[$dep]+x}" ] && continue
         if [ "${NODE_COLOR[$dep]}" = "1" ]; then
-          local cycle_key=$(echo "$path $dep" | tr ' ' '\n' | sort -n | tr '\n' ' ')
+          local cycle_key
+              cycle_key=$(echo "$path $dep" | tr ' ' '\n' | sort -n | tr '\n' ' ')
           if [ -z "${SEEN_CYCLES[$cycle_key]+x}" ]; then
             SEEN_CYCLES[$cycle_key]=1
             local in_cycle=0 cycle_str=""

supervisor/update-prompt.sh

@@ -39,7 +39,7 @@ else
   echo "$LESSON" >> "$TARGET_FILE"
 fi
 
-cd "$FACTORY_ROOT"
+cd "$FACTORY_ROOT" || exit 1
 git add "supervisor/$1" 2>/dev/null || git add "$TARGET_FILE"
 git commit -m "supervisor: learned — $(echo "$LESSON" | head -1 | sed 's/^#* *//')" --no-verify 2>/dev/null
 git push origin main 2>/dev/null