Package
Other
Description
Summary
In pre-commit mode (no explicit file list), scripts/check_dependency_confusion.py only scans staged files with these extensions:
.md, .py, .ts, .txt, .yaml, .yml, .ipynb, .svg
So staged shell scripts (.sh) are excluded, even when they contain executable pip install commands.
Affected file
scripts/check_dependency_confusion.py (staged-file filter in main())
Repository evidence
The repo contains shell scripts with real install commands, e.g.:
agent-governance-python/agent-os/modules/control-plane/build_and_publish.shagent-governance-python/agent-os/modules/scak/build_and_publish.sh
Why this matters
This creates a coverage gap in dependency-confusion checks for contributor tooling and release scripts.
Proposed fix
Extend staged-file scanning coverage to shell scripts and ensure parser logic distinguishes real command lines from echoed documentation strings.
Suggested tests
Add tests to verify:
- Real shell command lines like
pip install ... are scanned.
echo "pip install ..." instructional lines do not create false positives.- Existing behavior for currently scanned file types remains unchanged.
Acceptance criteria
- Pre-commit mode includes
.sh files in dependency-confusion scanning.
- False positives for echoed command examples are avoided.
- Regression tests cover shell-script scanning behavior.
Code of Conduct
Package
Other
Description
Summary
In pre-commit mode (no explicit file list),
scripts/check_dependency_confusion.pyonly scans staged files with these extensions:.md,.py,.ts,.txt,.yaml,.yml,.ipynb,.svgSo staged shell scripts (
.sh) are excluded, even when they contain executablepip installcommands.Affected file
scripts/check_dependency_confusion.py(staged-file filter inmain())Repository evidence
The repo contains shell scripts with real install commands, e.g.:
agent-governance-python/agent-os/modules/control-plane/build_and_publish.shagent-governance-python/agent-os/modules/scak/build_and_publish.shWhy this matters
This creates a coverage gap in dependency-confusion checks for contributor tooling and release scripts.
Proposed fix
Extend staged-file scanning coverage to shell scripts and ensure parser logic distinguishes real command lines from echoed documentation strings.
Suggested tests
Add tests to verify:
pip install ...are scanned.echo "pip install ..."instructional lines do not create false positives.Acceptance criteria
.shfiles in dependency-confusion scanning.Code of Conduct