fix(danger): close coverage gaps from PR #43 review

- Detect chmod setuid/setgid via '=' symbolic modes (u=rws, a=rwxs)
- Add regression tests for '=' symbolic chmod cases
- Fix staticcheck QF1001 in isAssignment via De Morgan's law
- Check devnull.Close() error in test cleanup

Author: jkyberneees

internal/danger/classifier.go

@@ -1622,7 +1622,7 @@ func isAssignment(tok string) bool {
 		return false
 	}
 	for _, r := range tok[:eq] {
-		if !(r == '_' || (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9')) {
+		if r != '_' && (r < 'A' || r > 'Z') && (r < 'a' || r > 'z') && (r < '0' || r > '9') {
 			return false
 		}
 	}
@@ -1912,9 +1912,10 @@ func isSystemWrite(first string, tokens []string) bool {
 }
 
 // chmodSetsSUIDGID reports whether a chmod invocation sets the setuid or setgid
-// bit, either symbolically (u+s, g+s, +s) or via an octal mode whose leading
-// special-permission digit includes 4 (setuid) or 2 (setgid) — e.g. 4755, 2755,
-// 6755. A plain 3- or 4-digit mode with a 0 special digit (0755) does not.
+// bit, either symbolically (u+s, g+s, +s, u=rws, a=rwxs, …) or via an octal
+// mode whose leading special-permission digit includes 4 (setuid) or 2
+// (setgid) — e.g. 4755, 2755, 6755. A plain 3- or 4-digit mode with a 0
+// special digit (0755) does not.
 //
 // Only the mode argument (the first non-flag operand) is inspected; trailing
 // tokens are filenames and must not trigger on an incidental "+...s" or octal
@@ -1924,13 +1925,19 @@ func chmodSetsSUIDGID(tokens []string) bool {
 		if strings.HasPrefix(tok, "-") {
 			continue // flag (e.g. -R, --recursive, --reference=FILE)
 		}
-		// Symbolic: any clause that adds the 's' permission (u+s, g+s, a+s, +s,
-		// ug+rs, …). We only care about additions, so look for "+...s".
+		// Symbolic: any clause that sets the 's' permission (u+s, g+s, a+s, +s,
+		// ug+rs, u=rws, a=rwxs, …). Both '+' (add) and '=' (set exactly) can
+		// introduce the setuid/setgid bit.
 		if plus := strings.IndexByte(tok, '+'); plus >= 0 {
 			if strings.ContainsRune(tok[plus+1:], 's') {
 				return true
 			}
 		}
+		if eq := strings.IndexByte(tok, '='); eq >= 0 {
+			if strings.ContainsRune(tok[eq+1:], 's') {
+				return true
+			}
+		}
 		// Octal: a 4-digit mode whose first digit has bit 4 (setuid) or 2
 		// (setgid) set. 3-digit modes have no special-permission digit.
 		if len(tok) == 4 && isOctalMode(tok) {

internal/danger/coverage_extension_test.go

@@ -68,6 +68,8 @@ func TestClassify_ChmodSUIDGID_IsSystemWrite(t *testing.T) {
 		"chmod 2755 /tmp/x",
 		"chmod 6755 /tmp/x",
 		"chmod ug+rs /tmp/x",
+		"chmod u=rws /tmp/x",
+		"chmod a=rwxs /tmp/x",
 	}
 	for _, c := range cmds {
 		t.Run(c, func(t *testing.T) {

internal/danger/whitebox_coverage_test.go

@@ -121,7 +121,9 @@ func silenceStderr(t *testing.T) {
 	os.Stderr = devnull
 	t.Cleanup(func() {
 		os.Stderr = orig
-		devnull.Close()
+		if err := devnull.Close(); err != nil {
+			t.Errorf("close /dev/null: %v", err)
+		}
 	})
 }
 
@@ -375,6 +377,7 @@ func TestIsOctalMode(t *testing.T) {
 func TestChmodSetsSUIDGID_Direct(t *testing.T) {
 	yes := [][]string{
 		{"chmod", "u+s", "f"}, {"chmod", "g+s", "f"}, {"chmod", "+s", "f"},
+		{"chmod", "u=rws", "f"}, {"chmod", "a=rwxs", "f"},
 		{"chmod", "4755", "f"}, {"chmod", "2755", "f"}, {"chmod", "6755", "f"},
 		{"chmod", "-R", "u+s", "f"}, // flag skipped, mode still inspected
 	}
@@ -387,6 +390,7 @@ func TestChmodSetsSUIDGID_Direct(t *testing.T) {
 		{"chmod", "+x", "f"}, {"chmod", "755", "f"}, {"chmod", "0755", "f"},
 		{"chmod", "1755", "f"},          // sticky only
 		{"chmod", "644", "build+gen.s"}, // filename, not mode
+		{"chmod", "u=rw", "f"},          // no special permission
 		{"chmod"},                       // no operand
 	}
 	for _, toks := range no {