refactor(packaging): name the arguments, and test the way the rest do

[Reefact]

Summary

SonarQube reports 19 open issues on this repository and all 19 are in tools/packaging/verify-published.sh and its test — seven shelldre:S7688 ([[ over [) and twelve shelldre:S7679 (name the positional parameter). Both rules are right here, and the reason is not the rules: these two scripts are the only ones in the repository that do not already do what they ask.

Type of change

• Refactoring
• Build / CI / tooling

Changes

• [ becomes [[ at all seven sites. Every other .sh under tools/ and tests/ already tests with [[, and the shebang here is bash, so [ was not buying portability it could spend.
• url_for had already named its two arguments id and ver — as globals, which leak. Nothing depends on the leak today, and only by accident: the sole caller wraps the call in a command substitution, so the assignments happen in a subshell that never reaches the for id in "$@" loop sharing the name. local makes that true because of how the function is written rather than because of how it happens to be called.
• is_published is named too, and it is the judgement call: it is a one-line helper whose whole body is a single curl, the shape sonar.yml already excuses for tests/PackageSmokeTest/run.sh. But the line that excuse actually draws is not one-line-ness — run.sh leaves $1 alone in step, pass, fail, get and status, all of which take one argument, and writes local what="$1" expected="$2" actual="$3" in expect, which does not. is_published and url_for take two, in an order no call site recovers.
• publish and check in the test are named for the same reason. check gains the most: it was [ "$2" = "$3" ] over a call written check "…" "$status" 1, so which side was expected and which was actual could only be learned by going to find out. A comment above it records that its order is the mirror of run.sh's expect, since the two are otherwise the same helper.
• No suppression is added. The ignore list in sonar.yml does not grow, so both rules keep reporting in these files.

Testing

None of the three boxes above are ticked, because none of the three were run and none of them would have measured this change — it touches two shell scripts and no C#, no project file and no packable output. What was run instead:

• git ls-files '*.sh' | xargs shellcheck — clean, which is the check CI runs over shell here.
• tools/packaging/verify-published.test.sh — passes, and it is the real script under test against a file:// feed rather than a stub.
• The test was confirmed still able to fail: deleting the id lowercasing from url_for makes it report FAIL: both packages on the feed — expected exit 0, got 1, which also shows the new expected/actual names are wired the right way round.
• The script's output on a missing package was captured before and after the change and diffed: byte-identical.
• tools/style/lint-layout.sh and the lint-layout / commit-lint self-tests — clean, unaffected.

Public API

• No change to the public surface

Documentation

• No documentation change required

No CHANGELOG.md entry: tooling-only commits here do not take one — 13e40b5, which created both of these files, 17e9ef7 and 42158ec all left it untouched.

Related issues

None.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QTqbBNpEX6L4xGuRH6d7rn

---

Generated by Claude Code