From a062b22a35652f42913e52092c73efdea885c822 Mon Sep 17 00:00:00 2001
From: haelyra <49814733+haelyra@users.noreply.github.com>
Date: Sat, 10 Oct 2026 18:36:28 -0400
Subject: [PATCH] fix(ci): provision real ripgrep for secret-scanner workflow
 checks

Verify PCRE2 on every hosted test platform and coverage runner. Preserve dependency PATH for real scanner delegates and report missing prerequisites explicitly, keeping production fail-closed behavior and hermetic missing/error controls intact.
---
 .github/workflows/ci.yml          | 37 +++++++++++++++++++++++++++++++
 tests/scripts/codex-hooks.test.js |  8 +++++--
 2 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f1f889ab..af75f8696 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,6 +44,36 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
 
+      - name: Install and verify ripgrep (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y ripgrep
+          rg --version
+          printf 'ecc-pcre2-probe\n' | rg --pcre2 -- '^ecc-pcre2-probe$'
+
+      - name: Install and verify ripgrep (macOS)
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          if ! command -v rg >/dev/null 2>&1; then brew install ripgrep; fi
+          rg --version
+          printf 'ecc-pcre2-probe\n' | rg --pcre2 -- '^ecc-pcre2-probe$'
+
+      - name: Install and verify ripgrep (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          if (-not (Get-Command rg -ErrorAction SilentlyContinue)) {
+            choco install ripgrep --yes --no-progress
+            if ($LASTEXITCODE -ne 0) { throw 'ripgrep installation failed' }
+          }
+          rg --version
+          if ($LASTEXITCODE -ne 0) { throw 'ripgrep executable is unavailable' }
+          'ecc-pcre2-probe' | rg --pcre2 -- '^ecc-pcre2-probe$'
+          if ($LASTEXITCODE -ne 0) { throw 'ripgrep PCRE2 support is required' }
+
       # Package manager setup
       - name: Setup pnpm
         if: matrix.pm == 'pnpm' && matrix.node != '18.x'
@@ -362,6 +392,13 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Install and verify ripgrep
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y ripgrep
+          rg --version
+          printf 'ecc-pcre2-probe\n' | rg --pcre2 -- '^ecc-pcre2-probe$'
+
       - name: Run coverage
         run: npm run coverage
 
diff --git a/tests/scripts/codex-hooks.test.js b/tests/scripts/codex-hooks.test.js
index db583f5fd..a4f6e388b 100644
--- a/tests/scripts/codex-hooks.test.js
+++ b/tests/scripts/codex-hooks.test.js
@@ -193,13 +193,17 @@ git_path="$(command -v git)"
 awk_path="$(command -v awk)"
 head_path="$(command -v head)"
 cat_path="$(command -v cat)"
-rg_path="$(command -v rg || true)"
+rg_path="$(type -P rg || true)"
+${scanner === 'real' ? `if [[ -z "$rg_path" ]]; then
+printf 'Real scanner fixture requires ripgrep with PCRE2 support on PATH.\\n' >&2
+exit 97
+fi` : ''}
 git() { "$git_path" "$@"; }
 awk() { "$awk_path" "$@"; }
 head() { "$head_path" "$@"; }
 cat() { "$cat_path" "$@"; }
 unset -f rg
-PATH="${toBashPath(binDir)}"
+${scanner === 'real' ? '# Preserve dependencies used by an actual scanner executable or wrapper.' : `PATH="${toBashPath(binDir)}"`}
 ${scanner ? `rg() {
 printf '%s\\n' "$*" >> "${toBashPath(callsPath)}"
 ${scanner === 'real' ? '"$rg_path" "$@"' : scanner === 'finding' ? "printf '1:synthetic-scanner-finding\\n'; return 0;" : scanner === 'error' ? 'return 2;' : 'return 1;'}