From a271dd86d1b1f1e1f7310785a28fd8766dfde1df Mon Sep 17 00:00:00 2001
From: "qodo-code-review[bot]"
 <151058649+qodo-code-review[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 16:02:24 +0000
Subject: [PATCH] fix: Fail closed on allowlist filtering errors

---
 scripts/public-repo-guard/body-policy.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/public-repo-guard/body-policy.sh b/scripts/public-repo-guard/body-policy.sh
index a0b421f..171158b 100755
--- a/scripts/public-repo-guard/body-policy.sh
+++ b/scripts/public-repo-guard/body-policy.sh
@@ -49,10 +49,15 @@ check() {
   # Filter with rg, not grep: BSD/macOS grep has no -P, so a `grep -P` allowlist
   # silently errors out locally while working on GNU/CI — the gate would then
   # disagree with itself depending on where it ran. rg is already required above.
-  local matches
+  local matches filter_rc
   matches="$(printf '%s' "$raw" \
     | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' \
-    | rg -vNiP -- "$ABOUT_THE_CONTROL" || true)"
+    | rg -vNiP -- "$ABOUT_THE_CONTROL")"
+  filter_rc=$?
+  if (( filter_rc >= 2 )); then
+    echo "::error title=public-repo-guard ($name)::ripgrep failed (exit $filter_rc) while applying allowlists — failing closed."
+    exit 2
+  fi
   [[ -z "$matches" ]] && return 0
   local count; count="$(printf '%s\n' "$matches" | grep -c '')"
   # Print the LINE NUMBER only — never the matched text. This annotation is itself