From 8db7708fbba1218b65a3b38865dce4f20c07d86c Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:47:23 +0000
Subject: [PATCH 1/2] Fix CodeRabbit issues in PR #682

---
 tools/policy/check-language-policy.sh | 13 +++++++------
 tools/policy/check-workflows-parse.sh |  2 +-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/tools/policy/check-language-policy.sh b/tools/policy/check-language-policy.sh
index 205ce015..ca64d836 100755
--- a/tools/policy/check-language-policy.sh
+++ b/tools/policy/check-language-policy.sh
@@ -31,25 +31,26 @@ for f in $files; do
   fi
   # 2. The rule that told repos not to declare dependencies at all. hyperpolymath/ubicity
   # a phrase inside a blockquote or quotation marks is HISTORY, not policy
-  live(){ grep -vE '^[[:space:]]*>' "$1" | grep -vE '"[^"]*'"$2"'[^"]*"|“[^”]*'"$2"'[^”]*”'; }
+  live(){ grep -vE '^[[:space:]]*>' "$1" | grep -vE '"[^"]*('"$2"')[^"]*"|“[^”]*('"$2"')[^”]*”'; }
   #    imported zod and glob, shipped no manifest, and could not build under ANY toolchain.
-  if live "$f" 'No package.json for runtime deps' | grep -qF 'No package.json for runtime deps'; then
+  if live "$f" 'No package.json for runtime deps' | grep -F 'No package.json for runtime deps' >/dev/null; then
     fail "$f:$(grep -nF 'No package.json for runtime deps' "$f" | head -1 | cut -d: -f1)" \
          'Forbids declaring dependencies. Bun is npm-compatible; a manifest is REQUIRED.'
   fi
-  if live "$f" 'deno.json imports' | grep -qF 'deno.json imports'; then
+  if live "$f" 'deno.json imports' | grep -F 'deno.json imports' >/dev/null; then
     fail "$f:$(grep -nF 'deno.json imports' "$f" | head -1 | cut -d: -f1)" \
          'Directs dependency declaration into deno.json. Use package.json + bun.lock.'
   fi
   # 3. No tool description may advertise TypeScript. Owner ruling 2026-08-27:
   #    "no typescript ... that should not exist at all."
-  if grep -nE 'Executes .\.ts. directly|JS/TS runtime' "$f" >/dev/null; then
-    fail "$f:$(grep -nE 'Executes .\.ts. directly|JS/TS runtime' "$f" | head -1 | cut -d: -f1)" \
+  typescript_runtime='Executes .\.ts. directly|JS/TS runtime|[Ss]upports? TypeScript|[Rr]uns? [^[:alnum:][:space:]]*\.ts[^[:alnum:][:space:]]* files?'
+  if live "$f" "$typescript_runtime" | grep -E "$typescript_runtime" >/dev/null; then
+    fail "$f:$(grep -nE "$typescript_runtime" "$f" | head -1 | cut -d: -f1)" \
          'Advertises TypeScript execution. TypeScript is banned; do not describe tools as TS runtimes.'
   fi
   # 4. Blanking scars. A bulk purge substituted a token with an EMPTY STRING, which also
   #    produced `rm -rf /lib` in wordpress-tools (the lethal shape is <token>/path -> /path).
-  if awk -F'|' 'NF>=4 && $2 ~ /^[[:space:]]*$/{exit 0} END{exit 1}' "$f"; then
+  if awk -F'|' 'NF>=4 && $2 ~ /^[[:space:]]*$/{found=1; exit} END{exit !found}' "$f"; then
     fail "$f" 'Policy table row with an EMPTY first cell - blanking scar from a bulk substitution.'
   fi
   if grep -nF '| **** |' "$f" >/dev/null; then
diff --git a/tools/policy/check-workflows-parse.sh b/tools/policy/check-workflows-parse.sh
index 773a906b..6756f0f8 100755
--- a/tools/policy/check-workflows-parse.sh
+++ b/tools/policy/check-workflows-parse.sh
@@ -20,7 +20,7 @@ elif command -v python3  >/dev/null 2>&1 && python3 -c 'import yaml' 2>/dev/null
 elif command -v ruby     >/dev/null 2>&1; then parser=ruby
 else
   echo "::warning::no YAML parser available (yq, python3+pyyaml, or ruby) — cannot verify workflows"
-  exit 0
+  exit 1
 fi
 
 parse_ok() {

From d173949a4611d608bb677eab0d5b2bc21af2bd9a Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 29 Aug 2026 03:37:40 +0100
Subject: [PATCH 2/2] Update tools/policy/check-workflows-parse.sh

Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 tools/policy/check-workflows-parse.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/policy/check-workflows-parse.sh b/tools/policy/check-workflows-parse.sh
index 6756f0f8..50c9ccb8 100755
--- a/tools/policy/check-workflows-parse.sh
+++ b/tools/policy/check-workflows-parse.sh
@@ -19,7 +19,7 @@ if command -v yq        >/dev/null 2>&1; then parser=yq
 elif command -v python3  >/dev/null 2>&1 && python3 -c 'import yaml' 2>/dev/null; then parser=python
 elif command -v ruby     >/dev/null 2>&1; then parser=ruby
 else
-  echo "::warning::no YAML parser available (yq, python3+pyyaml, or ruby) — cannot verify workflows"
+  echo "::error::no YAML parser available (yq, python3+pyyaml, or ruby) — cannot verify workflows"
   exit 1
 fi