`set -o pipefail` at the top of tests.sh combined with `find ... | head -1`
is a silent-killer pattern. When `find` produces lots of matches (e.g.
when uv has installed dozens of third-party packages with test_*.py
files under .venv), `head -1` reads its single line and closes the pipe.
`find` writes again, gets SIGPIPE, exits 141. pipefail propagates 141.
`set -e` fires. tests.sh exits 141 before printing `-- Python (pytest ...) --`
or any other output. run-all.sh records `tests: failed` with no
indication of WHY.
Reproduced directly:
bash -c 'set -euo pipefail; x=$(find <large-tree> -name "test_*.py" -o -name "*_test.py" | head -1); echo "got: $x"'
exit=141 # "got:" never prints
Fix: replace `| head -1` with `-print -quit` so find stops itself
after the first match instead of getting cut off mid-write. As a free
bonus, also prune the well-known noise dirs (.venv, .git, etc.) so the
probe doesn't even consider third-party test files in the first place —
this keeps the probe fast on dense trees and avoids matching
@pytest.fixture-decorated files in installed packages.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Preserve pre-existing WIP from master's working tree. When a project
has a uv.lock alongside pyproject.toml, run pip-audit and pytest under
`uv run --directory $project` so they execute in the project's own
managed venv instead of whatever pytest/pip-audit happens to be on PATH.
Lifted verbatim from master's uncommitted working tree; committed on
this branch as the base for subsequent Bug B (tests.sh SIGPIPE) and
Bug C (pip-audit venv) fixes which both modify these regions.
The `-not -path "*/.*"` filter on the `find` probes in lint.sh and sast.sh
was intended to exclude .venv / .git / __pycache__ but also excludes any
target path that lives UNDER a hidden ancestor directory.
Concrete trigger: running the gauntlet on a Claude Code worktree at
.../.claude/worktrees/<name>/. Every file in the tree matches `*/.*` via
the .claude/ component, so the probes return empty, the scripts skip
with "No Python or Go files found", and run-all.sh records the check as
passed by virtue of the 0 exit. The check never actually ran.
Switch to explicit prunes for the well-known noise dirs. As a free
bonus, replace `| head -1` with `-print -quit` so the probe also stops
being susceptible to SIGPIPE under `set -o pipefail` (relevant on dense
trees with many matches).
Verified: probe now returns first .py file in both .claude/-rooted and
normal project paths.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
