fix(e2e): use the tls lookup instead of the unregistered urlsplit filter; autoformat

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

group_vars/all/11_oidc.yml

@@ -12,10 +12,13 @@
 # @see https://en.wikipedia.org/wiki/OpenID_Connect
 
 # Helper Variables:
-_oidc_client_realm: "{{ OIDC_OVERRIDE.CLIENT.REALM if OIDC_OVERRIDE is defined and OIDC_OVERRIDE.CLIENT is defined and OIDC_OVERRIDE.CLIENT.REALM is defined else SOFTWARE_DOMAIN }}"
-_oidc_url: "{{ ( OIDC_OVERRIDE.URL if (OIDC_OVERRIDE is defined and OIDC_OVERRIDE.URL is defined) else (lookup('tls', 'web-app-keycloak', 'url.base')) ).rstrip('/') }}"
+_oidc_client_realm: "{{ OIDC_OVERRIDE.CLIENT.REALM if OIDC_OVERRIDE is defined and OIDC_OVERRIDE.CLIENT is defined and OIDC_OVERRIDE.CLIENT.REALM is defined else
+  SOFTWARE_DOMAIN }}"
+_oidc_url: "{{ ( OIDC_OVERRIDE.URL if (OIDC_OVERRIDE is defined and OIDC_OVERRIDE.URL is defined) else (lookup('tls', 'web-app-keycloak', 'url.base')) ).rstrip('/')
+  }}"
 _oidc_client_issuer_url: "{{ _oidc_url ~ '/realms/' ~ _oidc_client_realm }}"
-_oidc_client_id: "{{ OIDC_OVERRIDE.CLIENT.ID if OIDC_OVERRIDE is defined and OIDC_OVERRIDE.CLIENT is defined and OIDC_OVERRIDE.CLIENT.ID is defined else SOFTWARE_DOMAIN }}"
+_oidc_client_id: "{{ OIDC_OVERRIDE.CLIENT.ID if OIDC_OVERRIDE is defined and OIDC_OVERRIDE.CLIENT is defined and OIDC_OVERRIDE.CLIENT.ID is defined else SOFTWARE_DOMAIN
+  }}"
 _oidc_account_url: "{{ _oidc_client_issuer_url ~ '/account' }}"
 _oidc_protocol_oidc: "{{ _oidc_client_issuer_url ~ '/protocol/openid-connect' }}"
 

roles/svc-db-redis/meta/variants.yml

@@ -5,4 +5,4 @@
 - services:
     tor:
       enabled: false
-      shared: false  # nocheck: variants-static-override
+      shared: false # nocheck: variants-static-override

roles/svc-prx-openresty/meta/variants.yml

@@ -5,4 +5,4 @@
 - services:
     tor:
       enabled: false
-      shared: false  # nocheck: variants-static-override
+      shared: false # nocheck: variants-static-override

roles/sys-ctl-hlth-webserver/tasks/01_core.yml

@@ -33,7 +33,8 @@
     system_service_tpl_exec_start: >
       {{ system_service_script_exec }}
       --web-protocol {{ lookup('tls', DOMAIN_PRIMARY, 'protocols.web') }}
-      --expectations '{{ lookup('applications') | web_health_expectations(www_enabled=WWW_REDIRECT_ENABLED | bool, group_names=lookup('deployment').deployed, primary_domain=DOMAIN_PRIMARY, node_onion=lookup('config', 'svc-net-tor', 'services.tor.node', '')) | to_json
+      --expectations '{{ lookup('applications') | web_health_expectations(www_enabled=WWW_REDIRECT_ENABLED | bool, group_names=lookup('deployment').deployed, primary_domain=DOMAIN_PRIMARY,
+      node_onion=lookup('config', 'svc-net-tor', 'services.tor.node', '')) | to_json
       }}'
     system_service_force_flush_final: true
 

roles/test-e2e-playwright/tasks/02_run_one.yml

@@ -305,7 +305,8 @@
       - --ipc=host
       - --shm-size=1g
       - --add-host=host.docker.internal:host-gateway
-      - "{{ ('--add-host=' ~ (OIDC.CLIENT.ISSUER_URL | urlsplit('hostname')) ~ ':host-gateway') if ('web-app-keycloak' in group_names) else '--add-host=host.docker.internal:host-gateway' }}"
+      - "{{ ('--add-host=' ~ lookup('tls', 'web-app-keycloak', 'domain') ~ ':host-gateway') if ('web-app-keycloak' in group_names) else '--add-host=host.docker.internal:host-gateway'
+        }}"
       - --env-file
       - "{{ _playwright_stage_dir }}/.env"
       - -e
@@ -321,7 +322,8 @@
       - -e
       - "PLAYWRIGHT_TIMEOUT_FACTOR={{ TIMEOUT_FACTOR }}"
       - -e
-      - "PLAYWRIGHT_NAVIGATION_TIMEOUT={{ TEST_E2E_PLAYWRIGHT_ONION_NAVIGATION_TIMEOUT if (TEST_E2E_PLAYWRIGHT_IS_ONION | bool) else TEST_E2E_PLAYWRIGHT_NAVIGATION_TIMEOUT }}"
+      - "PLAYWRIGHT_NAVIGATION_TIMEOUT={{ TEST_E2E_PLAYWRIGHT_ONION_NAVIGATION_TIMEOUT if (TEST_E2E_PLAYWRIGHT_IS_ONION | bool) else TEST_E2E_PLAYWRIGHT_NAVIGATION_TIMEOUT
+        }}"
       - -e
       - "PLAYWRIGHT_GLOBAL_TIMEOUT={{ ((TEST_E2E_PLAYWRIGHT_RUN_TIMEOUT_EFFECTIVE | int) - 120) * 1000 }}"
       - -v

roles/web-app-decidim/meta/services.yml

@@ -71,4 +71,4 @@ seaweedfs:
 tor:
   bond: 1
   enabled: "{{ 'svc-net-tor' in group_names }}"
-  shared: true  # nocheck: dynamic-flag
+  shared: true # nocheck: dynamic-flag

roles/web-app-espocrm/meta/services.yml

@@ -74,4 +74,4 @@ prometheus:
 tor:
   bond: 1
   enabled: "{{ 'svc-net-tor' in group_names }}"
-  shared: true  # nocheck: dynamic-flag
+  shared: true # nocheck: dynamic-flag

roles/web-app-gitlab/meta/services.yml

@@ -73,4 +73,4 @@ prometheus:
 tor:
   bond: 1
   enabled: "{{ 'svc-net-tor' in group_names }}"
-  shared: true  # nocheck: dynamic-flag
+  shared: true # nocheck: dynamic-flag

roles/web-app-jira/meta/services.yml

@@ -54,4 +54,4 @@ prometheus:
 tor:
   bond: 1
   enabled: "{{ 'svc-net-tor' in group_names }}"
-  shared: true  # nocheck: dynamic-flag
+  shared: true # nocheck: dynamic-flag

roles/web-app-jira/meta/variants.yml

@@ -50,4 +50,4 @@
       shared: false
     tor:
       enabled: false
-      shared: false  # nocheck: variants-static-override
+      shared: false # nocheck: variants-static-override

roles/web-app-keycloak/meta/variants.yml

@@ -60,6 +60,6 @@
       shared: false
     tor:
       enabled: false
-      shared: false  # nocheck: variants-static-override
+      shared: false # nocheck: variants-static-override
   credentials:
     administrator_password: "'$tr0ng€xampl3PW!"

roles/web-app-minio/meta/variants.yml

@@ -60,7 +60,7 @@
       shared: false
     tor:
       enabled: false
-      shared: false  # nocheck: variants-static-override
+      shared: false # nocheck: variants-static-override
 - services:
     ldap:
       enabled: true
@@ -88,4 +88,4 @@
       shared: false
     tor:
       enabled: false
-      shared: false  # nocheck: variants-static-override
+      shared: false # nocheck: variants-static-override

roles/web-app-mobilizon/meta/variants.yml

@@ -56,4 +56,4 @@
       shared: false
     tor:
       enabled: false
-      shared: false  # nocheck: variants-static-override
+      shared: false # nocheck: variants-static-override

roles/web-app-pixelfed/meta/services.yml

@@ -89,4 +89,4 @@ prometheus:
 tor:
   bond: 1
   enabled: "{{ 'svc-net-tor' in group_names }}"
-  shared: true  # nocheck: dynamic-flag
+  shared: true # nocheck: dynamic-flag

roles/web-app-prometheus/meta/services.yml

@@ -103,4 +103,4 @@ node-exporter:
 tor:
   bond: 1
   enabled: "{{ 'svc-net-tor' in group_names }}"
-  shared: true  # nocheck: dynamic-flag
+  shared: true # nocheck: dynamic-flag

roles/web-app-prometheus/meta/variants.yml

@@ -47,4 +47,4 @@
       shared: false
     tor:
       enabled: false
-      shared: false  # nocheck: variants-static-override
+      shared: false # nocheck: variants-static-override

roles/web-app-shopware/meta/services.yml

@@ -149,4 +149,4 @@ prometheus:
 tor:
   bond: 1
   enabled: "{{ 'svc-net-tor' in group_names }}"
-  shared: true  # nocheck: dynamic-flag
+  shared: true # nocheck: dynamic-flag

scripts/container/purge/apps.sh

@@ -58,10 +58,10 @@ for app in "${apps[@]}"; do
 done
 
 echo ">>> Wiping token-store entries for: ${apps[*]}"
-"${python_bin}" -m utils.cleanup.tokens "${apps[@]}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+"${python_bin}" -m utils.cleanup.tokens "${apps[@]}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 echo ">>> Wiping databases.csv entries for: ${apps[*]}"
-"${python_bin}" -m utils.cleanup.databases_csv "${apps[@]}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+"${python_bin}" -m utils.cleanup.databases_csv "${apps[@]}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 if [[ "${#entities[@]}" -lt 1 ]]; then
 	echo "!!! WARNING: no valid entities found: skipping entity purge"
@@ -71,12 +71,12 @@ fi
 for entity in "${entities[@]}"; do
 	echo
 	echo ">>> Purging entity: ${entity}"
-	bash "${ENTITY_DIR}/nginx.sh" "${entity}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	bash "${ENTITY_DIR}/nginx.sh" "${entity}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	if [[ -d "/opt/compose/${entity}" ]]; then
-		bash "${ENTITY_DIR}/db.sh" "${entity}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-		bash "${ENTITY_DIR}/compose.sh" "${entity}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-		bash "${ENTITY_DIR}/dir.sh" "${entity}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-		bash "${ENTITY_DIR}/network.sh" "${entity}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		bash "${ENTITY_DIR}/db.sh" "${entity}" || true      # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		bash "${ENTITY_DIR}/compose.sh" "${entity}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		bash "${ENTITY_DIR}/dir.sh" "${entity}" || true     # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		bash "${ENTITY_DIR}/network.sh" "${entity}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	else
 		echo ">>> /opt/compose/${entity} not present — skipping compose/db/dir/network purges"
 	fi

scripts/container/purge/entity/compose.sh

@@ -32,7 +32,7 @@ for STACK_NAME in "$@"; do
 
 		log "Compose down for '${STACK_NAME}'..."
 		cd "$STACK_DIR"
-		run_no_stdin compose down --remove-orphans -v || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		run_no_stdin compose down --remove-orphans -v || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	) || {
 		rc=$?
 		overall_rc=1

scripts/container/purge/entity/db.sh

@@ -249,21 +249,21 @@ for STACK_NAME in "$@"; do
 			KC_DB_URL="$(env_get "${ENV_FILE}" KC_DB_URL || true)"
 
 			if [[ -n "${KC_DB}" ]]; then
-				echo "${KC_DB}" | grep -qi postgres && DB_BACKEND="postgres" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-				echo "${KC_DB}" | grep -qi mariadb && DB_BACKEND="mariadb" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+				echo "${KC_DB}" | grep -qi postgres && DB_BACKEND="postgres" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+				echo "${KC_DB}" | grep -qi mariadb && DB_BACKEND="mariadb" || true   # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 			fi
 
 			if [[ -n "${KC_DB_URL}" ]]; then
-				echo "${KC_DB_URL}" | grep -qi postgresql && DB_BACKEND="postgres" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-				echo "${KC_DB_URL}" | grep -qi mariadb && DB_BACKEND="mariadb" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+				echo "${KC_DB_URL}" | grep -qi postgresql && DB_BACKEND="postgres" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+				echo "${KC_DB_URL}" | grep -qi mariadb && DB_BACKEND="mariadb" || true     # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 				DB_NAME="$(echo "${KC_DB_URL}" | sed -E 's|.*/([^/?#]+).*|\1|')"
 			fi
 
 			if [[ -z "${DB_BACKEND}" ]]; then
-				grep -qi postgres "${ENV_FILE}" && DB_BACKEND="postgres" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+				grep -qi postgres "${ENV_FILE}" && DB_BACKEND="postgres" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 			fi
 			if [[ -z "${DB_BACKEND}" ]]; then
-				grep -qi mariadb "${ENV_FILE}" && DB_BACKEND="mariadb" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+				grep -qi mariadb "${ENV_FILE}" && DB_BACKEND="mariadb" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 			fi
 		else
 			warn "Env file not found (${ENV_FILE}) — DB name defaults to stack name '${DB_NAME}'"

scripts/github/resolve/pick_distro.sh

@@ -15,7 +15,7 @@ ALL_DISTROS=(arch debian ubuntu fedora centos)
 version_tag="$(
 	git tag --points-at "${GITHUB_SHA}" |
 		grep -E '^v[0-9]+(\.[0-9]+)*$' |
-		head -n 1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		head -n 1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 )"
 
 if [[ -n "$version_tag" ]]; then

scripts/github/runner/cleanup_docker.sh

@@ -6,13 +6,13 @@
 set -euo pipefail
 
 echo "=== Cleanup ==="
-docker buildx prune -af || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker buildx prune -af || true   # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 docker builder prune -af || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-docker image prune -af || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-docker container prune -f || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker image prune -af || true    # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker container prune -f || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 echo
 echo "=== Disk pressure: AFTER CLEANUP ==="
 df -h
 echo
-docker system df || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-docker buildx du || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker system df || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker buildx du || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error

scripts/github/runner/disk_pressure_report.sh

@@ -14,10 +14,10 @@ echo "Runner: $(uname -a)"
 echo
 df -h
 echo
-docker version || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker version || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 echo
-docker system df || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker system df || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 echo
-docker buildx version || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker buildx version || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 echo
-docker buildx du || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker buildx du || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error

scripts/github/runner/dump_state.sh

@@ -22,10 +22,10 @@ echo "--- disk (inodes) ---"
 df -hi / /mnt 2>/dev/null || df -hi /
 
 echo "--- block devices ---"
-lsblk -f || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+lsblk -f || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 echo "--- mounts (/, /mnt, /var/lib/docker, /mnt/docker) ---"
-mount | grep -E ' / | /mnt | /var/lib/docker | /mnt/docker ' || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+mount | grep -E ' / | /mnt | /var/lib/docker | /mnt/docker ' || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 echo "--- docker ---"
 docker info 2>/dev/null |
@@ -39,11 +39,11 @@ echo "--- swap ---"
 swapon --show || echo "no swap active"
 
 echo "--- largest dirs on / (top 15) ---"
-sudo du -xh --max-depth=2 / 2>/dev/null | sort -h | tail -15 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+sudo du -xh --max-depth=2 / 2>/dev/null | sort -h | tail -15 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 if [ -d /mnt ]; then
 	echo "--- largest dirs on /mnt (top 15) ---"
-	sudo du -xh --max-depth=2 /mnt 2>/dev/null | sort -h | tail -15 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	sudo du -xh --max-depth=2 /mnt 2>/dev/null | sort -h | tail -15 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 fi
 
 # Nested view — hlth-disc-space runs INSIDE the infinito container and
@@ -58,7 +58,7 @@ if [ -n "${INFINITO_CONTAINER}" ]; then
 	docker exec "${INFINITO_CONTAINER}" df -h 2>&1 || echo "docker exec df failed"
 
 	echo "--- df --output=pcent inside container (what hlth-disc-space sees) ---"
-	docker exec "${INFINITO_CONTAINER}" df --output=pcent 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker exec "${INFINITO_CONTAINER}" df --output=pcent 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	echo "--- failed systemd units inside container ---"
 	docker exec "${INFINITO_CONTAINER}" systemctl --failed --no-pager 2>&1 ||

scripts/github/runner/enlarge_swap.sh

@@ -34,7 +34,7 @@ MIN_FREE_GB=$((SWAP_GB + 4)) # need the target size plus a little slack
 
 "$DUMP" "before swap resize"
 
-sudo swapoff -a || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+sudo swapoff -a || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 sudo rm -f /mnt/swapfile /swapfile
 
 # Only treat /mnt as a candidate if it is actually a separate mount.

scripts/github/update/open_role_prs.sh

@@ -57,4 +57,4 @@ for entry in "${entries[@]}"; do
 		bash "${SCRIPT_DIR}/open_pr.sh" "${ROOT}/${entry}"
 done
 
-git checkout --quiet --force --detach "${base}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+git checkout --quiet --force --detach "${base}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error

scripts/image/cleanup.sh

@@ -151,9 +151,9 @@ gh_api_json() {
 	shift # orgs|users
 
 	if [[ "${method}" == "GET" ]]; then
-		gh api -H "Accept: application/vnd.github+json" "/${scope}/${OWNER}/${endpoint}" "$@" 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		gh api -H "Accept: application/vnd.github+json" "/${scope}/${OWNER}/${endpoint}" "$@" 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	else
-		gh api -X "${method}" -H "Accept: application/vnd.github+json" "/${scope}/${OWNER}/${endpoint}" "$@" 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		gh api -X "${method}" -H "Accept: application/vnd.github+json" "/${scope}/${OWNER}/${endpoint}" "$@" 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	fi
 }
 

scripts/install/all.sh

@@ -52,5 +52,5 @@ ANSIBLE_COLLECTIONS_DIR="${HOME}/.ansible/collections" bash scripts/install/ansi
 
 stamp_dir="$(dirname "${STAMP}")"
 mkdir -p "${stamp_dir}"
-chmod 0777 "${stamp_dir}" 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+chmod 0777 "${stamp_dir}" 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 touch "${STAMP}"

scripts/install/package.sh

@@ -25,7 +25,7 @@ build_and_install_arch() {
 	pacman-key --init
 	pacman-key --populate archlinux
 	# Tolerate missing manjaro keyring on pure Arch images (no manjaro.gpg present).
-	pacman-key --populate manjaro 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	pacman-key --populate manjaro 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	echo "[arch] Installing build toolchain..."
 	pacman -Syu --noconfirm --needed base-devel sudo rsync
@@ -132,7 +132,7 @@ build_and_install_rpm_like() {
 	echo "[rpm] Installing ${rpm_path} via ${pm}..."
 	bootstrap_docker_repo
 	"${pm}" -y install "${rpm_path}"
-	"${pm}" -y clean all || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	"${pm}" -y clean all || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 }
 
 main() {

scripts/lint/autoformat.sh

@@ -180,9 +180,9 @@ if is_truthy "${PARALLEL}"; then
 	# `|| true` so `set -e` does not abort the parent if any worker
 	# exited non-zero — write_status has still run, and we want to reach
 	# the summary block.
-	wait || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	wait || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 else
-	for w in "${workers[@]}"; do "${w}" || true; done  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	for w in "${workers[@]}"; do "${w}" || true; done # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 fi
 
 # ── summary ──────────────────────────────────────────────────────────────────

scripts/meta/resolve/apps.sh

@@ -122,7 +122,7 @@ if [[ -n "${GITHUB_ACTIONS:-}" && -z "${ACT:-}" ]]; then
 			--required-storage "${required_storage}" \
 			--warnings \
 			--format json \
-			>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 		# Real filter (JSON output)
 		apps_json="$(

scripts/setup.sh

@@ -13,7 +13,7 @@ echo "🔧 Running project setup (no installation)"
 # Optional: show interpreter for debugging
 echo "🐍 Using PYTHON=${PYTHON}"
 if command -v "${PYTHON}" >/dev/null 2>&1; then
-	"${PYTHON}" -c 'import sys; print("sys.executable=", sys.executable)' || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	"${PYTHON}" -c 'import sys; print("sys.executable=", sys.executable)' || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 fi
 
 ROLES_DIR="./roles"

scripts/system/apparmor/teardown.sh

@@ -13,7 +13,7 @@ if ! apparmor_should_manage; then
 fi
 
 if apparmor_service_exists; then
-	systemctl stop apparmor || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	systemctl stop apparmor || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 else
 	echo "[apparmor] apparmor.service not available or systemd inactive; skipping service stop"
 fi
@@ -21,7 +21,7 @@ fi
 if command -v aa-teardown >/dev/null 2>&1; then
 	aa-teardown || apparmor_warn "[apparmor] aa-teardown returned non-zero; continuing"
 elif command -v apparmor_parser >/dev/null 2>&1 && compgen -G '/etc/apparmor.d/*' >/dev/null; then
-	apparmor_parser -R /etc/apparmor.d/* || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	apparmor_parser -R /etc/apparmor.d/* || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 else
 	echo "[apparmor] no AppArmor profile tooling available; skipping profile unload"
 fi

scripts/system/cache/clean.sh

@@ -32,8 +32,8 @@ source "scripts/meta/env/load.sh"
 # scope to the two cache services explicitly.
 if docker ps --format '{{.Names}}' | grep -qE '^infinito-(registry|package)-cache$'; then
 	echo "[clean-cache] stopping infinito-registry-cache + infinito-package-cache"
-	docker stop infinito-registry-cache infinito-package-cache 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-	docker rm infinito-registry-cache infinito-package-cache 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker stop infinito-registry-cache infinito-package-cache 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker rm infinito-registry-cache infinito-package-cache 2>/dev/null || true   # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 fi
 
 PATHS=(

scripts/system/meta/disk-usage.sh

@@ -9,7 +9,7 @@ run_if_available() {
 	shift
 	command -v "$1" >/dev/null 2>&1 || return 0
 	echo "=== ${label} ==="
-	"$@" 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	"$@" 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	echo ""
 }
 

scripts/system/network/dns/common.sh

@@ -162,7 +162,7 @@ dns_test_resolution() {
 	echo ">>> Testing resolution"
 	if [[ "${DNS_HOSTS_FILE}" == "/etc/hosts" ]]; then
 		while IFS= read -r host; do
-			getent hosts "${host}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			getent hosts "${host}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 			checked=$((checked + 1))
 			if [[ "${checked}" -ge 3 ]]; then
 				break

scripts/system/network/dns/remove.sh

@@ -23,11 +23,11 @@ if systemctl is-active --quiet NetworkManager 2>/dev/null; then
 fi
 
 # Remove system dnsmasq snippet (fallback setup)
-sudo rm -f "${DNS_SYS_DNSMASQ_CONF}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+sudo rm -f "${DNS_SYS_DNSMASQ_CONF}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 # If system dnsmasq is active, restart to apply
 if systemctl is-active --quiet dnsmasq 2>/dev/null; then
-	sudo systemctl restart dnsmasq || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	sudo systemctl restart dnsmasq || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 fi
 
 echo ">>> Removed."

scripts/system/network/dns/setup/linux.sh

@@ -54,7 +54,7 @@ configure_via_networkmanager_dnsmasq() {
 	# Avoid port conflicts with a system-wide dnsmasq service
 	if systemctl is-enabled --quiet dnsmasq 2>/dev/null || systemctl is-active --quiet dnsmasq 2>/dev/null; then
 		echo ">>> Disabling system dnsmasq to avoid conflicts with NetworkManager dnsmasq"
-		sudo systemctl disable --now dnsmasq || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		sudo systemctl disable --now dnsmasq || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	fi
 
 	echo ">>> Writing NetworkManager dnsmasq config: ${DNS_NM_CONF}"
@@ -76,7 +76,7 @@ EOF
 	sudo systemctl restart NetworkManager
 
 	echo ">>> Resolver status"
-	cat /etc/resolv.conf || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	cat /etc/resolv.conf || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 }
 
 configure_via_system_dnsmasq() {
@@ -97,8 +97,8 @@ EOF
 	# Optional: systemd-resolved integration if it exists, but NEVER fail the script
 	if command -v resolvectl >/dev/null 2>&1 && systemctl is-active --quiet systemd-resolved 2>/dev/null; then
 		echo ">>> Configuring systemd-resolved routing for ${DNS_DOMAIN}"
-		sudo resolvectl dns lo 127.0.0.1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-		sudo resolvectl domain lo "~${DNS_DOMAIN}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		sudo resolvectl dns lo 127.0.0.1 || true           # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		sudo resolvectl domain lo "~${DNS_DOMAIN}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	else
 		echo ">>> systemd-resolved not active -> skipping resolvectl integration"
 		echo ">>> NOTE: Ensure your system resolver uses 127.0.0.1 to query dnsmasq."

scripts/system/network/dns/setup/wsl.sh

@@ -50,7 +50,7 @@ sudo rm -f "${RESOLV_CONF}"
 printf 'nameserver 127.0.0.1\n' | sudo tee "${RESOLV_CONF}" >/dev/null
 
 echo ">>> Restarting dnsmasq"
-sudo systemctl enable dnsmasq --quiet 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+sudo systemctl enable dnsmasq --quiet 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 sudo systemctl restart dnsmasq
 
 # Register WSL interop binfmt handler so Windows .exe files can be executed from WSL
@@ -62,7 +62,7 @@ if [[ ! -f "${BINFMT_CONF}" ]]; then
 	sudo systemctl restart systemd-binfmt
 fi
 if ! grep -qs "WSLInterop" /proc/sys/fs/binfmt_misc/WSLInterop 2>/dev/null; then
-	printf ':WSLInterop:M::MZ::/init:PF\n' | sudo tee /proc/sys/fs/binfmt_misc/register >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	printf ':WSLInterop:M::MZ::/init:PF\n' | sudo tee /proc/sys/fs/binfmt_misc/register >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 fi
 
 echo ">>> WSL2 DNS pre-configuration complete"

scripts/tests/deploy/ci/dedicated.sh

@@ -68,19 +68,19 @@ cleanup() {
 	mkdir -p "${_playwright_host_dir}"
 	echo ">>> Copying Playwright artifacts from ${INFINITO_CONTAINER} to ${_playwright_host_dir}"
 	docker cp "${INFINITO_CONTAINER}:/var/lib/infinito/logs/test-e2e-playwright/." \
-		"${_playwright_host_dir}" 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		"${_playwright_host_dir}" 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	if [[ -n "${ANSIBLE_LOG_PATH:-}" ]]; then
 		echo ">>> Copying Ansible log from ${INFINITO_CONTAINER}:${ANSIBLE_LOG_PATH} to ${ANSIBLE_LOG_PATH}"
-		docker cp "${INFINITO_CONTAINER}:${ANSIBLE_LOG_PATH}" "${ANSIBLE_LOG_PATH}" 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		docker cp "${INFINITO_CONTAINER}:${ANSIBLE_LOG_PATH}" "${ANSIBLE_LOG_PATH}" 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	fi
 
 	echo ">>> Removing stack for distro ${INFINITO_DISTRO} (fresh start for next distro)"
-	"${PYTHON}" -m cli.administration.deploy.development down || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	"${PYTHON}" -m cli.administration.deploy.development down || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	echo ">>> HARD cleanup (containers/volumes/networks/images/build-cache)"
 	echo ">>> Docker disk usage before HARD cleanup"
-	docker system df || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker system df || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	# 1) Remove containers belonging to this compose project only.
 	# On shared self-hosted runners multiple projects run in parallel;
@@ -92,24 +92,24 @@ cleanup() {
 		mapfile -t ids < <(docker ps -aq || true)
 	fi
 	if ((${#ids[@]} > 0)); then
-		docker rm -f "${ids[@]}" >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		docker rm -f "${ids[@]}" >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	fi
 
 	# 2) Remove networks (except default ones)
-	docker network prune -f >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker network prune -f >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	# 3) Remove ALL volumes
-	docker volume prune -f >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker volume prune -f >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	# 4) Optional: leftover stopped containers (usually redundant after rm -f)
-	docker container prune -f >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker container prune -f >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	# 5) Remove all images + build cache (frees disk on GitHub runners).
 	# Skipped on self-hosted (INFINITO_PRESERVE_DOCKER_CACHE=true) to keep the cache warm.
 	if [[ "${INFINITO_PRESERVE_DOCKER_CACHE}" != "true" ]]; then
-		docker image prune -af >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		docker image prune -af >/dev/null 2>&1 || true   # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 		docker buildx prune -af >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-		docker builder prune -af >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		docker builder prune -af >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	else
 		# On self-hosted runners keep only the current CI image per distro.
 		# Removes all older ci-<hash> tags so disk usage stays flat across runs.
@@ -123,7 +123,7 @@ cleanup() {
 			)
 			if ((${#_old_ci_images[@]} > 0)); then
 				echo ">>> Pruning ${#_old_ci_images[@]} stale CI image(s) for ${_image_repo}"
-				docker rmi "${_old_ci_images[@]}" >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+				docker rmi "${_old_ci_images[@]}" >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 			fi
 		fi
 	fi
@@ -137,17 +137,17 @@ cleanup() {
 			echo ">>> CI cleanup: wiping Docker root: ${INFINITO_DOCKER_VOLUME}"
 
 			echo ">>> Pre-clean ownership/permissions (best-effort)"
-			ls -ld "${INFINITO_DOCKER_VOLUME}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			ls -ld "${INFINITO_DOCKER_VOLUME}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 			echo ">>> Removing host docker volume dir: ${INFINITO_DOCKER_VOLUME}"
-			sudo rm -rf "${INFINITO_DOCKER_VOLUME}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-			sudo mkdir -vp "${INFINITO_DOCKER_VOLUME}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			sudo rm -rf "${INFINITO_DOCKER_VOLUME}" || true    # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			sudo mkdir -vp "${INFINITO_DOCKER_VOLUME}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 			# Optional: keep it writable for the runner user
-			sudo chown -R "$(id -u):$(id -g)" "${INFINITO_DOCKER_VOLUME}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			sudo chown -R "$(id -u):$(id -g)" "${INFINITO_DOCKER_VOLUME}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 			echo ">>> Post-clean ownership/permissions (best-effort)"
-			ls -ld "${INFINITO_DOCKER_VOLUME}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			ls -ld "${INFINITO_DOCKER_VOLUME}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 		else
 			echo "[WARN] INFINITO_DOCKER_VOLUME is not an absolute path: '${INFINITO_DOCKER_VOLUME}' (skipping)"
 		fi
@@ -155,11 +155,11 @@ cleanup() {
 
 	# 7) Remove root-owned __pycache__/.pyc (else the next checkout fails with EACCES).
 	echo ">>> Removing root-owned Python bytecode from workspace"
-	sudo find "${REPO_ROOT}" -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-	sudo find "${REPO_ROOT}" -name "*.pyc" -delete 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	sudo find "${REPO_ROOT}" -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	sudo find "${REPO_ROOT}" -name "*.pyc" -delete 2>/dev/null || true                         # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	echo ">>> Docker disk usage after HARD cleanup"
-	docker system df || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker system df || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	echo ">>> HARD cleanup finished"
 	return $rc
 }
@@ -171,12 +171,12 @@ if [[ "${INFINITO_PRESERVE_DOCKER_CACHE}" == "true" ]]; then
 	_disk_pct=$(df --output=pcent / | tail -1 | tr -d ' %')
 	if [[ "${_disk_pct}" -ge 70 && -n "${INFINITO_DOCKER_VOLUME:-}" && "${INFINITO_DOCKER_VOLUME}" == /* ]]; then
 		echo ">>> Disk at ${_disk_pct}% — wiping full inner-Docker volume to reclaim space: ${INFINITO_DOCKER_VOLUME}"
-		sudo rm -rf "${INFINITO_DOCKER_VOLUME}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-		sudo mkdir -p "${INFINITO_DOCKER_VOLUME}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-		sudo chown -R "$(id -u):$(id -g)" "${INFINITO_DOCKER_VOLUME}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		sudo rm -rf "${INFINITO_DOCKER_VOLUME}" || true                       # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		sudo mkdir -p "${INFINITO_DOCKER_VOLUME}" || true                     # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		sudo chown -R "$(id -u):$(id -g)" "${INFINITO_DOCKER_VOLUME}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	else
 		echo ">>> Wiping inner-Docker volumes and container state: ${INFINITO_DOCKER_VOLUME}"
-		sudo rm -rf "${INFINITO_DOCKER_VOLUME}/volumes" "${INFINITO_DOCKER_VOLUME}/containers" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		sudo rm -rf "${INFINITO_DOCKER_VOLUME}/volumes" "${INFINITO_DOCKER_VOLUME}/containers" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	fi
 fi
 
@@ -191,7 +191,7 @@ echo ">>> Ensuring stack is up for distro ${INFINITO_DISTRO}"
 _up_container="${INFINITO_CONTAINER:?INFINITO_CONTAINER is not set (run make dotenv)}"
 docker exec "${_up_container}" install -m 755 \
 	/opt/src/infinito/roles/sys-ca-selfsigned/files/with-ca-trust.sh \
-	/usr/bin/ca-trust-wrapper 2>/dev/null || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	/usr/bin/ca-trust-wrapper 2>/dev/null || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 deploy_args=(
 	--apps "${apps}"
@@ -200,8 +200,8 @@ deploy_args=(
 )
 
 echo ">>> DISK / DOCKER STATE BEFORE DEPLOY (distro=${INFINITO_DISTRO})"
-df -h || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-docker system df || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+df -h || true            # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker system df || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 echo ">>> END STATE BEFORE DEPLOY"
 
 _init_args=(
@@ -232,6 +232,6 @@ echo ">>> deploy (PASS 1 sync + PASS 2 async per variant, --full-cycle)"
 "${PYTHON}" -m cli.administration.deploy.development deploy "${deploy_args[@]}" --full-cycle
 
 echo ">>> DISK / DOCKER STATE AFTER DEPLOY (before cleanup, distro=${INFINITO_DISTRO})"
-df -h || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-docker system df || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+df -h || true            # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+docker system df || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 echo ">>> END STATE AFTER DEPLOY"

scripts/tests/deploy/local/deploy/container/initialize/all.sh

@@ -39,7 +39,7 @@ mkdir -p "${inv_dir}"
 
 if [[ ! -f "${pw_file}" ]]; then
 	printf '%s\n' 'local-vault-password' >"${pw_file}"
-	chmod 600 "${pw_file}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	chmod 600 "${pw_file}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 fi
 
 echo ">>> Creating inventory at ${INFINITO_INVENTORY_FILE}"

scripts/tests/deploy/local/utils/cache-retry.sh

@@ -64,9 +64,9 @@ cache_retry_recover() {
 	done
 
 	echo "[cache-retry] docker builder prune -af..."
-	docker builder prune -af >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker builder prune -af >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	echo "[cache-retry] docker image prune -af..."
-	docker image prune -af >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker image prune -af >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 }
 
 # Toggle errexit around the pipeline so a wrapped non-zero exit reaches the caller

scripts/tests/dns.sh

@@ -112,7 +112,7 @@ section "CoreDNS container status"
 _coredns_name="${INFINITO_RUNNER_PREFIX:-}-coredns"
 if docker ps --filter name="${_coredns_name}" --format '{{.Names}}' | grep -q "${_coredns_name}"; then
 	docker ps --filter name="${_coredns_name}" --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}'
-	docker logs --tail=10 "${_coredns_name}" || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker logs --tail=10 "${_coredns_name}" || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	ok "CoreDNS container is running"
 else
 	fail "CoreDNS container not running"

scripts/tests/environment/05_commit.sh

@@ -42,23 +42,23 @@ cleanup() {
 		local current_ref
 		current_ref="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
 		if [[ "${current_ref}" == "${TEST_BRANCH}" ]]; then
-			git reset --hard HEAD >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-			git clean -fd >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
-			git checkout "${ORIGINAL_REF}" >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			git reset --hard HEAD >/dev/null 2>&1 || true          # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			git clean -fd >/dev/null 2>&1 || true                  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+			git checkout "${ORIGINAL_REF}" >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 		fi
-		git branch -D "${TEST_BRANCH}" >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		git branch -D "${TEST_BRANCH}" >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	fi
 
 	if [[ -n "${ORIGINAL_GIT_USER_NAME}" ]]; then
-		git config --local user.name "${ORIGINAL_GIT_USER_NAME}" >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		git config --local user.name "${ORIGINAL_GIT_USER_NAME}" >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	else
-		git config --local --unset user.name >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		git config --local --unset user.name >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	fi
 
 	if [[ -n "${ORIGINAL_GIT_USER_EMAIL}" ]]; then
-		git config --local user.email "${ORIGINAL_GIT_USER_EMAIL}" >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		git config --local user.email "${ORIGINAL_GIT_USER_EMAIL}" >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	else
-		git config --local --unset user.email >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		git config --local --unset user.email >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 	fi
 
 	if [[ -n "${WORKTREE_STASH}" ]] && git stash list | grep -F "${WORKTREE_STASH}" >/dev/null 2>&1; then

scripts/tests/environment/11_console.sh

@@ -35,7 +35,7 @@ printf '%s\n' \
 	'/' \
 	'exit' |
 	"${PYTHON}" -m cli.console \
-		>"${log_file}" 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+		>"${log_file}" 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 assert_log_contains() {
 	local needle="${1}"

scripts/tests/environment/utils/cache.sh

@@ -260,7 +260,7 @@ probe_did_inner_build() {
 		rc=1
 	fi
 	rm -rf "${tmpdir}"
-	docker rmi "${tag}" >/dev/null 2>&1 || true  # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
+	docker rmi "${tag}" >/dev/null 2>&1 || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 
 	if [[ "${rc}" -ne 0 ]]; then
 		echo "[FAIL] DiD probe: docker build failed (frontend, network or upstream broken)" >&2