Skip to content

fix(growth): replace BASH_SOURCE with git rev-parse (closes #3303) - #3317

Closed
AhmedTMM wants to merge 1 commit into
OpenRouterLabs:mainfrom
AhmedTMM:fix/growth-bash-source
Closed

fix(growth): replace BASH_SOURCE with git rev-parse (closes #3303)#3317
AhmedTMM wants to merge 1 commit into
OpenRouterLabs:mainfrom
AhmedTMM:fix/growth-bash-source

Conversation

@AhmedTMM

Copy link
Copy Markdown
Collaborator

Summary

Closes #3303. Replaces BASH_SOURCE[0]-based path resolution in growth.sh with git rev-parse --show-toplevel, which works regardless of invocation method.

Change

-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+SCRIPT_DIR="${REPO_ROOT}/.claude/skills/setup-agent-team"

Note

The same BASH_SOURCE pattern exists in refactor.sh, security.sh, and discovery.sh. Those are not touched here per the issue scope — they're also never curl-piped (always executed directly on the VM by trigger-server.ts), so the practical risk is zero, but the rule violation is technically real.

Test plan

  • bash -n growth.sh — syntax clean

Closes OpenRouterLabs#3303. BASH_SOURCE resolves to /dev/fd/XX under bash <(curl ...)
which violates .claude/rules/shell-scripts.md. Switched to git rev-parse
--show-toplevel which always works regardless of invocation method.

Applied only to growth.sh per the issue scope. The same pattern exists
in refactor.sh, security.sh, and discovery.sh but those are separate
issues and those scripts are also never curl-piped.
@AhmedTMM

Copy link
Copy Markdown
Collaborator Author

Closing — the underlying issue #3303 is a false positive (internal script, never curl-piped).

@AhmedTMM AhmedTMM closed this Apr 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

security: BASH_SOURCE usage in growth.sh breaks curl|bash compatibility

1 participant