fix(security): stop GG-SAST-DEAD_CODE flagging shebangs and prose comments

gitgalaxy/core/detector.py

@@ -2048,8 +2048,10 @@ def preserve_newlines(m):
         # pass would otherwise rewrite `'EOF'` -> `''` and the delimiter would
         # be lost, leaving the entire heredoc body live to corrupt the Mode-D
         # depth stack). `preserve_newlines` returns this match verbatim.
-        # Scoped to shell/bash: ruby's `<<` is also the append operator and
-        # elixir's is the bitstring builder, both of which this would false-match.
+        # Scoped to the Bourne-family shell lang_id (checked both by its resolved
+        # "shell" alias and the literal name below): ruby's `<<` is also the append
+        # operator and elixir's is the bitstring builder, both of which this would
+        # false-match.
         heredoc_opener_alt = (
             r"(?P<heredoc><<[-~]?[ \t]*(?:'[A-Za-z_]\w*'|\"[A-Za-z_]\w*\"|[A-Za-z_]\w*))|"
             if lang_id in ("shell", "bash")
@@ -4767,8 +4769,8 @@ def _slice_by_keywords(
         # docstring/comments for why a separate later pass was unsafe.
         # #1266: this call used to drop `lang_id` entirely (always passing
         # the implicit `None` default), which silently disabled BOTH the
-        # heredoc-protection branch for ruby/perl/elixir/shell/bash (each
-        # explicitly gated on `lang_id in [...]`, never actually reachable)
+        # heredoc-protection branch for ruby/perl/elixir/the Bourne-family shell
+        # id (each explicitly gated on `lang_id in [...]`, never actually reachable)
         # and, now, MATLAB's `%`-comment-marker resolution. Passing it
         # through is a strict correctness fix -- verified via
         # `crucible_check.py` to change nothing for the languages other than

gitgalaxy/core/prism.py

@@ -565,7 +565,7 @@ def _compile_delimiter_alternation(self, delimiters: list[str], lang_id: str = "
                 continue
 
             # In shell and makefile, '#' is only a comment if it is the start of a word (preceded by whitespace or start of line).
-            # This protects bash parameter expansions like `${var##prefix}` from being falsely stripped.
+            # This protects POSIX parameter expansions like `${var##prefix}` from being falsely stripped.
             if token == "#" and lang_id in ("shell", "makefile"):  # noqa: S105
                 alternatives.append(r"(?:^|(?<=\s))#")
                 continue

gitgalaxy/metrics/signal_processor.py

@@ -395,7 +395,7 @@ def calculate_risk_vector(
                 # 1. Zero out all standard architectural risks
                 blanket_risk_vector = [0.0] * len(self.RISK_SCHEMA)
 
-                # 2. Check for ANY malicious intent (eval, network fetching, etc.)
+                # 2. Check for ANY malicious intent (dynamic code execution, network fetching, etc.)
                 intent_mass = (
                     raw_signals.get("sec_high_risk_execution", 0)
                     + raw_signals.get("sec_io", 0)

gitgalaxy/security/security_lens.py

@@ -124,8 +124,15 @@ def __init__(self):
                 re.I,
             ),
             # 6. Commented-out Executable Logic (Deprecated Trails)
+            # BUG FIX (confirmed via this repo's own GitHub Advanced Security self-scan, #847):
+            # the bare `#` comment-marker alternative matched a script's own `#!/bin/bash`
+            # shebang line -- a `#` immediately followed by `!` is never "commented-out
+            # executable logic", it's the interpreter directive every real shell script
+            # requires. `(?!!)` excludes only that one shape; every other real `#`-comment
+            # (including a genuine commented-out `# curl ... | bash`) still matches exactly
+            # as before.
             "dead_code": re.compile(
-                r"(?://|#|--|\*>|^.{6}\*)[^\n]*?\b(?:http|bash|curl|wget|eval|base64|nc\s+-e|/dev/tcp|BPXBATCH)\b|"
+                r"(?://|#(?!!)|--|\*>|^.{6}\*)[^\n]*?\b(?:http|bash|curl|wget|eval|base64|nc\s+-e|/dev/tcp|BPXBATCH)\b|"
                 r"/\*(?:(?!\*/).){0,500}?\b(?:http|bash|curl|wget|eval|base64|nc\s+-e|/dev/tcp)\b",
                 re.I,
             ),