PR #255 - combsmith/repo-template

Problem

Review bots on combsmith/.github-private#2370 (the PR that mirrored this runbook into seed-repo-template.sh) raised valid findings about the runbook text itself, deferred to combsmith/.github-private#2047 because they can only be fixed here, upstream. This PR fixes them:

#	File / step	Defect	Fix
1	`BOOTSTRAP.md` step 6	`sonar-project.properties` example has trailing `# comments` after values; Java properties parsing keeps them as part of the value	Explanations moved above the block; example lines are bare
2	`BOOTSTRAP.md` step 7.4	instruction-file loop hard-codes `for lang in python shell`	`case "$STACK"` derives the list (frontend→typescript javascript, backend-go→go, backend-python→python, infra-terraform→terraform, fullstack→typescript javascript go terraform, backend-rust/none→none) and appends `shell` when the repo has `*.sh`; table added
3	`BOOTSTRAP.md` step 8	`git rm tests/.bats` contradicts the `STACK=none` exception that keeps some `ci-.bats`	Guards (`-stub.bats`, `gitignore-baseline.bats`, `pr-quality-ruleset.bats`) removed unconditionally; `git rm tests/ci-.bats` is a separate command gated by the exception
4	`BOOTSTRAP.md` step 7 check	`! grep -q …` passes when a listed file is missing (grep exit 2)	`rc` captured and branched: 1 = pass, 0 = placeholder survives, other = error, exit loudly
5	`BOOTSTRAP.md` step 2	no mention that `fullstack.yml` lacks a `pip` entry	Paragraph added: fullstack-with-Python copies the `pip` block from `backend-python.yml` (verified against `combsmith/.github` `standards/dependabot/`)
6	`AGENTS.md`	`brew install bats-core shellcheck yq` then requires Homebrew bash	`bash` added to the install list
7	`AGENTS.md`	`shellcheck *.sh` fails on the unmatched glob (no `.sh` ships)	find-based form: `find . -path ./.git -prune -o -name '*.sh' -exec shellcheck {} +`

Risk

Low. Documentation only; no workflow, stub or test file changes. The heredocs in .github-private are <<'EOF'-quoted and neither file gains a bare EOF line, so the mirror remains mechanical. Until the follow-up seeder PR lands, the next seed run would propose reverting these three files (known, tracked in combsmith/.github-private#2047).

Test plan

PATH=/opt/homebrew/bin:$PATH bats tests/ (bash 5.3): 137 pass, 8 fail in dependabot-github-actions-ecosystem.bats setup with yq is required but not installed — pre-existing local-env gap, unrelated to this diff; CI has yq.
Step 7.4 case block executed for all seven STACK values with and without a *.sh present: produces the documented lists, shell appended only when scripts exist.
Step 7 check executed against template files (exit 1, FAIL), a clean file (exit 0, OK) and a missing file (exit 2, ERROR).
Step 8 globs enumerate all 20 tests/*.bats (18 guards + ci files, with ci-*.bats separable).
AGENTS.md lint line runs clean on this repo (no .sh files, exit 0).
CI green on build-and-test, Secret scan (gitleaks), coverage, SonarCloud.

Rollback

git revert of the single commit. No external state.

Monitoring

After merge: re-mirror into combsmith/.github-private scripts/seed-repo-template.sh (heredocs, tests/fixtures/seed-repo-template/*.md, REPO_TEMPLATE_*_BLOB pins) so DRY_RUN=true bash scripts/seed-repo-template.sh --repo combsmith/repo-template reports SKIP for README.md, BOOTSTRAP.md and AGENTS.md. Closes the upstream half of combsmith/.github-private#2047.

🤖 Generated with Claude Code