test(staleness): drop eval from propagate test helper

Replace the `eval "$2"` assertion helper in propagate-workflow-pins-test.sh
with an eval-free `try CMD [ARGS...]` runner plus small predicate helpers
(contains / file_has / staged_has / ...). Behaviour and coverage unchanged
(11/11). Avoids contributing a code-injection-shaped pattern to the estate's
Hypatia finding set; eval-on-a-variable is a textbook scanner trigger.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BKyi8Bht8xdXyajpkaTdYP

Author: claude

scripts/tests/propagate-workflow-pins-test.sh

@@ -15,7 +15,20 @@ OLD="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
 TARGET="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
 
 PASS=0; TOTAL=0
-ok() { TOTAL=$((TOTAL + 1)); if eval "$2"; then echo "PASS: $1"; PASS=$((PASS + 1)); else echo "FAIL: $1"; fi; }
+
+# try DESC CMD [ARGS...] — runs CMD as a real command (no eval); PASS on exit 0.
+try() {
+  local desc="$1"; shift
+  TOTAL=$((TOTAL + 1))
+  if "$@"; then echo "PASS: $desc"; PASS=$((PASS + 1)); else echo "FAIL: $desc"; fi
+}
+
+# Small eval-free predicates usable as `try` commands.
+contains()      { case "$2" in *"$1"*) return 0 ;; *) return 1 ;; esac; }
+not_contains()  { case "$2" in *"$1"*) return 1 ;; *) return 0 ;; esac; }
+fresh_only()    { contains FRESH "$1" && not_contains BEHIND "$1"; }
+file_has()      { grep -q "$2" "$1"; }
+staged_has()    { git -C "$1" diff --cached --name-only | grep -q "$2"; }
 
 mk_consumer() { # dir
   mkdir -p "$1/.github/workflows"
@@ -41,41 +54,41 @@ EOF
 # ── 1. AUDIT mode reports BEHIND and does not modify files ──────────────────
 R="$TEST_DIR/audit"; mk_consumer "$R"
 OUT=$(bash "$PROP" --to "$TARGET" "$R")
-ok "audit reports BEHIND" '[[ "$OUT" == *BEHIND* ]]'
-ok "audit leaves file unchanged" 'grep -q "governance-reusable.yml@${OLD}" "$R/.github/workflows/governance.yml"'
+try "audit reports BEHIND" contains BEHIND "$OUT"
+try "audit leaves file unchanged" file_has "$R/.github/workflows/governance.yml" "governance-reusable.yml@${OLD}"
 
 # ── 2. FIX rewrites the standards pins to the target ────────────────────────
 R="$TEST_DIR/fix"; mk_consumer "$R"
 bash "$PROP" --fix --to "$TARGET" "$R" >/dev/null
-ok "fix bumps governance pin" 'grep -q "governance-reusable.yml@${TARGET}" "$R/.github/workflows/governance.yml"'
-ok "fix bumps scorecard pin"  'grep -q "scorecard-reusable.yml@${TARGET}" "$R/.github/workflows/scorecard.yml"'
+try "fix bumps governance pin" file_has "$R/.github/workflows/governance.yml" "governance-reusable.yml@${TARGET}"
+try "fix bumps scorecard pin"  file_has "$R/.github/workflows/scorecard.yml"  "scorecard-reusable.yml@${TARGET}"
 
 # ── 3. Non-standards action pins are NOT touched ────────────────────────────
-ok "actions/checkout pin untouched" 'grep -q "actions/checkout@${OLD}" "$R/.github/workflows/scorecard.yml"'
+try "actions/checkout pin untouched" file_has "$R/.github/workflows/scorecard.yml" "actions/checkout@${OLD}"
 
 # ── 4. After fix, audit reports FRESH (idempotent) ──────────────────────────
 OUT=$(bash "$PROP" --to "$TARGET" "$R")
-ok "post-fix audit reports FRESH" '[[ "$OUT" == *FRESH* && "$OUT" != *BEHIND* ]]'
+try "post-fix audit reports FRESH" fresh_only "$OUT"
 
 # ── 5. Re-running fix is a no-op (idempotent) ───────────────────────────────
 BEFORE=$(cat "$R/.github/workflows/governance.yml")
 bash "$PROP" --fix --to "$TARGET" "$R" >/dev/null
-ok "fix is idempotent" '[[ "$(cat "$R/.github/workflows/governance.yml")" == "$BEFORE" ]]'
+try "fix is idempotent" test "$(cat "$R/.github/workflows/governance.yml")" = "$BEFORE"
 
 # ── 6. --fix in a git repo stages a bump branch (no commit/push) ────────────
 R="$TEST_DIR/gitrepo"; mk_consumer "$R"
 git -C "$R" init -q
 git -C "$R" config user.email t@t; git -C "$R" config user.name t
 git -C "$R" add -A; git -C "$R" commit -q -m init
 bash "$PROP" --fix --to "$TARGET" "$R" >/dev/null 2>&1
-ok "fix creates bump branch" '[[ "$(git -C "$R" branch --show-current)" == "chore/bump-standards-pins" ]]'
-ok "fix stages the change (no commit)" 'git -C "$R" diff --cached --name-only | grep -q governance.yml'
+try "fix creates bump branch" test "$(git -C "$R" branch --show-current)" = "chore/bump-standards-pins"
+try "fix stages the change (no commit)" staged_has "$R" governance.yml
 
 # ── 7. Parent-dir mode processes multiple repos ─────────────────────────────
 ROOT="$TEST_DIR/many"; mk_consumer "$ROOT/repoA"; mk_consumer "$ROOT/repoB"
 OUT=$(bash "$PROP" --to "$TARGET" "$ROOT")
-ok "parent-dir mode sees repoA" '[[ "$OUT" == *repoA* ]]'
-ok "parent-dir mode sees repoB" '[[ "$OUT" == *repoB* ]]'
+try "parent-dir mode sees repoA" contains repoA "$OUT"
+try "parent-dir mode sees repoB" contains repoB "$OUT"
 
 echo "----------------------------------------"
 echo "$PASS/$TOTAL test cases passed."