Suppress SC2016 for literal behavior-defined engine configs

[Copilot]

Generated Crush configuration steps triggered SC2016 because the literal JSON key $schema is intentionally single-quoted.

• Generator

  • Emit # shellcheck disable=SC2016 directly above BASE_CONFIG when configuration content contains $.
  • Avoid suppressing SC2016 for unaffected configurations.

• Coverage

  • Cover both dollar-containing and ordinary JSON configurations.

• Generated workflows

  • Recompile the affected Crush workflow lock files.

# shellcheck disable=SC2016
BASE_CONFIG='{"$schema":"https://charm.land/crush.json"}'

• Fixes [static-analysis] Report - 2026-08-10 #51692

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.8 AIC · ⌖ 5.41 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Adds targeted SC2016 suppression for generated literal JSON engine configurations containing dollar signs.

Changes:

• Conditionally emits the ShellCheck directive above BASE_CONFIG.
• Tests dollar-containing and ordinary configurations.
• Recompiles affected Crush workflow locks.

Show a summary per file

File	Description
pkg/workflow/behavior_defined_engine.go	Generates conditional SC2016 suppression.
pkg/workflow/behavior_defined_engine_harness_test.go	Covers suppression behavior.
.github/workflows/smoke-crush.lock.yml	Updates generated Crush steps.
.github/workflows/daily-code-metrics.lock.yml	Updates generated Crush steps.
.github/workflows/daily-arxiv-researcher.lock.yml	Updates generated Crush steps.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

Triage: Suppress SC2016 for literal behavior-defined engine configs

• Category: bug (lint fix) | Risk: low | Score: 38/100 (impact 10, urgency 10, quality 18)
• Recommended action: auto_merge
• Notes: Small, well-tested shellcheck suppression fix (5 files). CI green (Windows build/integration + route checks passed). AI reviewer already commented. Good auto-merge candidate once final CI settles.

Generated by 🔧 PR Triage Agent · auto · 49.6 AIC · ⌖ 2.51 AIC · ⊞ 7.8K · ◷

[gh-aw-bot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, refresh the branch if GitHub can update it cleanly, and run the pr-finisher skill before handing this back to maintainers.

No unresolved review threads were surfaced in this pass.
No failed checks were listed in the compact candidate snapshot.
Branch refresh was requested.
Run details: https://github.com/github/gh-aw/actions/runs/31388253285

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.8 AIC · ⌖ 5.41 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot PR sous-chef triage: please refresh the current maintainer-facing state on the latest head, refresh the branch if GitHub can update it cleanly, and run the pr-finisher skill before handing ...

PR finisher pass complete:

• ✅ Reviews — no unresolved review threads; the automated review (copilot-pull-request-reviewer) reported 0 comments.
• ✅ Checks (local) — make fmt, make lint, and make test-unit all pass for changed packages. One pre-existing failure (TestEmbeddedContainerPins_DoNotIncludeVulnerableAstGrepImage) is present on main as well and is unrelated to this PR's changes.
• ❓ Checks (CI) — stale after agent push; needs human re-trigger. Prior runs were clean for this PR's scope.
• ✅ Mergeable — branch is OPEN, not draft, and already refreshed against main (merge commit 414d43a).

Actions taken: none needed — branch was already up to date and no threads required resolution.
Hand-off: CI must be re-triggered by a maintainer (close/reopen PR, workflow_dispatch, or a push) before merge. The pre-existing TestEmbeddedContainerPins_DoNotIncludeVulnerableAstGrepImage failure should be tracked separately.