[pjhartlieb]

Fixes review note V12 on #12: #11 inserted the dev-security.yml caller between the secrets example and "map it by name as above", so that sentence pointed at a block with no secrets. This moves the paragraph back under its example. Text unchanged; dev-security.yml unchanged.

[en0f]

Reviewed at e314ab1.

🟢 The secret-mapping note is back under the example it refers to, with no wording change

"Map it by name as above" now follows the release-check.yml example that maps BLS_RELEASE_PRIVATE_KEY, the README has exactly the base's lines, only reordered, and both yaml examples are untouched. dev-security.yml is unchanged, so a caller run pinned to #12's new head still answers the blocker there.

Reproduce this review

# save the script below as verify-13.sh, then:
bash verify-13.sh blacklanternsecurity/release-workflows e314ab19d6961ef8bca48b1b1f8e58d5089afe12
# expected: SUMMARY 4 PASS, 0 FAIL, 0 SKIP, 0 BROKEN
# control:  bash verify-13.sh blacklanternsecurity/release-workflows c3bc4cb3c30af3b71f7cebf02225cb0db810a564   -> V01 FAIL (SUMMARY 3 PASS, 1 FAIL, 0 SKIP, 0 BROKEN)

#!/usr/bin/env bash
# verify-13.sh: reproducible checks for blacklanternsecurity/release-workflows#13
# Usage: bash verify-13.sh <owner/repo> <sha> [<control-patch>]
# Changes nothing outside a mktemp directory and nothing on GitHub (PR-VF-02).
#
# CONTROL: sha c3bc4cb3c30af3b71f7cebf02225cb0db810a564
# CONTROL-EXPECT: V01=FAIL
set -uo pipefail

REPO="${1:?owner/repo}"; SHA="${2:?sha}"; PATCH="${3:-}"
BASE_SHA=c3bc4cb3c30af3b71f7cebf02225cb0db810a564
PASS=0; FAIL=0; SKIP=0; BROKEN=0
pass()   { echo "PASS $1 $2"; PASS=$((PASS+1)); }
fail()   { echo "FAIL $1 $2 -- $3"; FAIL=$((FAIL+1)); }
skip()   { echo "SKIP $1 $2 -- $3"; SKIP=$((SKIP+1)); }
broken() { echo "BROKEN $1 $2 -- $3"; BROKEN=$((BROKEN+1)); }
summary() { echo "SUMMARY $PASS PASS, $FAIL FAIL, $SKIP SKIP, $BROKEN BROKEN"; [ "$FAIL" -eq 0 ] && [ "$BROKEN" -eq 0 ]; }

echo "script_sha256 $(shasum -a 256 "$0" | cut -d' ' -f1)"
echo "git $(git --version | cut -d' ' -f3)"

WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 GIT_TERMINAL_PROMPT=0
GIT=(git -c credential.helper= -c 'credential.helper=!gh auth git-credential')
"${GIT[@]}" clone --quiet --filter=blob:none --no-checkout "https://github.com/$REPO.git" "$WORK/src" || { broken V00 "clone" "clone failed"; summary; exit 1; }
cd "$WORK/src"
"${GIT[@]}" cat-file -e "$SHA^{commit}" 2>/dev/null || "${GIT[@]}" fetch --quiet origin "+refs/pull/*/head:refs/remotes/pr/*" || true
"${GIT[@]}" checkout --quiet --detach "$SHA" || { broken V00 "checkout $SHA" "checkout failed"; summary; exit 1; }
[ "$(git rev-parse HEAD)" = "$SHA" ] || { broken V00 "HEAD is $SHA" "HEAD mismatch"; summary; exit 1; }
if [ -n "$PATCH" ]; then git apply "$PATCH" || { broken V00 "apply control patch" "git apply failed"; summary; exit 1; }; fi
"${GIT[@]}" cat-file -e "$BASE_SHA^{commit}" 2>/dev/null || { broken V00 "base $BASE_SHA present" "missing"; summary; exit 1; }

# ---- checks: each line states the desired property --------------------------
# The yaml example nearest above "map it by name as above" maps secrets by name.
NEAREST=$(awk '/^```yaml/{b="";f=1;next} f&&/^```/{f=0;last=b;next} f{b=b $0 "\n"} /name as above/{ if (last ~ /secrets:/) print "yes"; else print "no"; exit}' README.md)
case "$NEAREST" in yes) pass V01 "the example 'map it by name as above' refers to maps secrets by name";;
  no) fail V01 "the example 'map it by name as above' refers to maps secrets by name" "nearest yaml block above maps no secrets";;
  *) broken V01 "the example 'map it by name as above' refers to maps secrets by name" "sentence not found";; esac

# The moved paragraph's text is unchanged: README has the same lines as the base, only reordered.
if diff <(git show "$BASE_SHA:README.md" | sort) <(sort README.md) >/dev/null; then pass V02 "README has exactly the base's lines, only reordered"
else fail V02 "README has exactly the base's lines, only reordered" "line content differs from base"; fi

# Nothing but README.md differs from the base; dev-security.yml in particular is unchanged.
CHANGED=$(git diff --name-only "$BASE_SHA" HEAD | tr '\n' ' ')
if [ -z "$CHANGED" ] || [ "$CHANGED" = "README.md " ]; then pass V03 "only README.md differs from the base (dev-security.yml unchanged)"
else fail V03 "only README.md differs from the base" "changed: $CHANGED"; fi

# Each yaml example is intact: the release-check and dev-security blocks match the base byte for byte.
blocks() { awk '/^```yaml/{f=1} f{print} f&&/^```$/{f=0}' ; }
if diff <(git show "$BASE_SHA:README.md" | blocks) <(blocks < README.md) >/dev/null; then pass V04 "both yaml examples are unchanged from the base"
else fail V04 "both yaml examples are unchanged from the base" "a code block changed"; fi
# ------------------------------------------------------------------------------
summary