Fix CRITICAL_PREFIXES guard syntax in coverage script

Signed-off-by: Nathan Gillett <nathan@intentproof.io>

Author: Nathan Gillett

scripts/check-coverage.sh

@@ -47,11 +47,16 @@ fi
 
 if [[ -n "${CRITICAL_RULES:-}" ]]; then
   printf '%s\n' "${CRITICAL_RULES[@]}" >"$rules_file"
-elif [[ -n "${CRITICAL_MIN:-}" && ${#CRITICAL_PREFIXES[@]:-0} -gt 0 ]]; then
-  while IFS= read -r prefix; do
-    [[ -n "$prefix" ]] || continue
-    printf '%s:%s\n' "$CRITICAL_MIN" "$prefix"
-  done < <(printf '%s\n' "${CRITICAL_PREFIXES[@]}") >"$rules_file"
+elif [[ -n "${CRITICAL_MIN:-}" ]]; then
+  if declare -p CRITICAL_PREFIXES &>/dev/null && [[ ${#CRITICAL_PREFIXES[@]} -gt 0 ]]; then
+    while IFS= read -r prefix; do
+      [[ -n "$prefix" ]] || continue
+      printf '%s:%s\n' "$CRITICAL_MIN" "$prefix"
+    done < <(printf '%s\n' "${CRITICAL_PREFIXES[@]}") >"$rules_file"
+  else
+    echo "coverage-tiers.conf must set CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES" >&2
+    exit 2
+  fi
 else
   echo "coverage-tiers.conf must set CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES" >&2
   exit 2

scripts/check-coverage_config_test.sh

@@ -2,36 +2,50 @@
 # Regression test: missing critical tier config yields a clear error.
 set -euo pipefail
 
-root="$(mktemp -d)"
-trap 'rm -rf "$root"' EXIT
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-mkdir -p "$root/scripts"
-cp "$(dirname "$0")/check-coverage.sh" "$(dirname "$0")/check-coverage-aggregate.awk" \
-  "$root/scripts/"
+run_config_case() {
+  local conf_body="$1"
+  local label="$2"
 
-cat >"$root/scripts/coverage-tiers.conf" <<'EOF'
-TOTAL_MIN=90
+  local root
+  root="$(mktemp -d)"
+  # shellcheck disable=SC2064
+  trap "rm -rf '$root'" RETURN
+
+  mkdir -p "$root/scripts"
+  cp "$script_dir/check-coverage.sh" "$script_dir/check-coverage-aggregate.awk" \
+    "$root/scripts/"
+
+  cat >"$root/scripts/coverage-tiers.conf" <<EOF
+${conf_body}
 EOF
 
-cat >"$root/coverage.out" <<'EOF'
+  cat >"$root/coverage.out" <<'EOF'
 mode: atomic
 example.com/pkg/main.go:1.1,2.1 2 2
 EOF
 
-output=""
-code=0
-output="$(bash "$root/scripts/check-coverage.sh" "$root/coverage.out" 2>&1)" || code=$?
-
-if [[ "$code" -ne 2 ]]; then
-  echo "FAIL: expected exit 2 for incomplete config, got ${code}" >&2
-  echo "$output" >&2
-  exit 1
-fi
-
-if ! grep -q "must set CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES" <<<"$output"; then
-  echo "FAIL: expected descriptive config error, got:" >&2
-  echo "$output" >&2
-  exit 1
-fi
+  local output=""
+  local code=0
+  output="$(bash "$root/scripts/check-coverage.sh" "$root/coverage.out" 2>&1)" || code=$?
+
+  if [[ "$code" -ne 2 ]]; then
+    echo "FAIL (${label}): expected exit 2, got ${code}" >&2
+    echo "$output" >&2
+    return 1
+  fi
+
+  if ! grep -q "must set CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES" <<<"$output"; then
+    echo "FAIL (${label}): expected descriptive config error, got:" >&2
+    echo "$output" >&2
+    return 1
+  fi
+
+  return 0
+}
+
+run_config_case "TOTAL_MIN=90" "no critical tier keys" || exit 1
+run_config_case $'TOTAL_MIN=90\nCRITICAL_MIN=95' "CRITICAL_MIN without CRITICAL_PREFIXES" || exit 1
 
 echo "PASS: incomplete critical tier config reports clear error"