fix(qa): actionlint env-context, sonar exclude garbage, shell [[ ]]

Author: nikolay-e

.github/workflows/bench-sweep.yml

@@ -79,14 +79,11 @@ jobs:
     env:
       CELL_TAG: ${{ matrix.method }}_b${{ matrix.budget }}_${{ matrix.test_set }}
       CELL_DIR: results/sweep/${{ matrix.method }}_b${{ matrix.budget }}_${{ matrix.test_set }}
-      MANIFESTS_DIR: benchmarks/manifests/${{ env.MANIFESTS_SUBDIR }}
-      # Quote inputs into env so heredocs/shell can reference them as
-      # ordinary shell vars without GitHub-Actions template interpolation
-      # opening a script-injection seam.
-      INPUT_TAU: ${{ env.TAU }}
-      INPUT_CBF: ${{ env.CORE_BUDGET_FRACTION }}
-      INPUT_TIMEOUT: ${{ env.TIMEOUT_PER_INSTANCE }}
-      INPUT_MANIFESTS_SUBDIR: ${{ env.MANIFESTS_SUBDIR }}
+      MANIFESTS_DIR: benchmarks/manifests/v1
+      INPUT_TAU: '0.12'
+      INPUT_CBF: '0.5'
+      INPUT_TIMEOUT: '600'
+      INPUT_MANIFESTS_SUBDIR: v1
     steps:
       - uses: actions/checkout@v4
 
@@ -324,14 +321,14 @@ jobs:
       - name: Commit raw artifacts to results branch
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BR: ${{ env.RESULTS_BRANCH }}
+          BR: bench-results/sweep
           REPO: ${{ github.repository }}
           SWEEP_ID: ${{ needs.prep.outputs.sweep_id }}
           TS: ${{ needs.prep.outputs.ts }}
-          INPUT_TAU: ${{ env.TAU }}
-          INPUT_CBF: ${{ env.CORE_BUDGET_FRACTION }}
-          INPUT_TIMEOUT: ${{ env.TIMEOUT_PER_INSTANCE }}
-          INPUT_MANIFESTS_SUBDIR: ${{ env.MANIFESTS_SUBDIR }}
+          INPUT_TAU: '0.12'
+          INPUT_CBF: '0.5'
+          INPUT_TIMEOUT: '600'
+          INPUT_MANIFESTS_SUBDIR: v1
         run: |
           git config user.name 'github-actions[bot]'
           git config user.email 'github-actions[bot]@users.noreply.github.com'

scripts/build_bench_image.sh

@@ -34,15 +34,15 @@ docker buildx inspect --bootstrap >/dev/null
 
 CACHE_FROM_ARGS=()
 CACHE_TO_ARGS=()
-if [ -n "$CACHE_REF" ]; then
+if [[ -n "$CACHE_REF" ]]; then
   CACHE_FROM_ARGS+=(--cache-from "type=registry,ref=$CACHE_REF")
   CACHE_TO_ARGS+=(--cache-to "type=registry,ref=$CACHE_REF,mode=max,image-manifest=true,oci-mediatypes=true")
 fi
 
 OUTPUT_ARGS=()
-if [ "$PUSH" = "1" ]; then
+if [[ "$PUSH" == "1" ]]; then
   OUTPUT_ARGS+=(--push)
-elif [ "$(echo "$PLATFORMS" | tr ',' '\n' | wc -l)" = "1" ]; then
+elif [[ "$(echo "$PLATFORMS" | tr ',' '\n' | wc -l)" == "1" ]]; then
   # Single platform — load to local docker daemon
   OUTPUT_ARGS+=(--load)
 else

sonar-project.properties

@@ -1,6 +1,10 @@
 sonar.projectKey=nikolay-e_TreeMapper
 sonar.organization=nikolay-e
 
+# Garbage fixtures: intentionally noisy "fake real code" used as negative-test
+# distractors. Unused params, dead code, etc. are by design.
+sonar.exclusions=diffctx/tests/fixtures/garbage/**
+
 # Suppress S5332 (HTTP instead of HTTPS) for XML namespace URIs in GraphML output and tests.
 # These are W3C/GraphML spec namespace identifiers, not network requests.
 sonar.issue.ignore.multicriteria=e1,e2