From 0920fa1fa91f48a32e3960f788bd5c5fa5e68a60 Mon Sep 17 00:00:00 2001
From: riccardom <riccardomanfrin@gmail.com>
Date: Tue, 19 May 2026 09:04:40 +0200
Subject: [PATCH] Address SonarCloud quality gate

- Use [[ ]] for conditional tests in generate.sh scripts
- Pin arduino/setup-protoc to full commit SHA
---
 .github/workflows/proto-version-check.yml | 2 +-
 client/proto/generate.sh                  | 2 +-
 encryption/testprotos/generate.sh         | 2 +-
 flow/proto/generate.sh                    | 2 +-
 shared/management/proto/generate.sh       | 2 +-
 shared/signal/proto/generate.sh           | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/proto-version-check.yml b/.github/workflows/proto-version-check.yml
index b888f98c1..34338abd8 100644
--- a/.github/workflows/proto-version-check.yml
+++ b/.github/workflows/proto-version-check.yml
@@ -33,7 +33,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Setup protoc
-        uses: arduino/setup-protoc@v3
+        uses: arduino/setup-protoc@f4d5893b897028ff5739576ea0409746887fa536 # v3.0.0
         with:
           version: ${{ env.PROTOC_VERSION }}
           repo-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/client/proto/generate.sh b/client/proto/generate.sh
index 2ea9dc4bc..d043614eb 100755
--- a/client/proto/generate.sh
+++ b/client/proto/generate.sh
@@ -17,7 +17,7 @@ repo_root=$(git rev-parse --show-toplevel)
 . "$repo_root/proto-tools.env"
 
 actual_protoc=$(protoc --version | awk '{print $2}')
-if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+if [[ "$actual_protoc" != "$PROTOC_VERSION" ]]; then
   echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
   echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
   exit 1
diff --git a/encryption/testprotos/generate.sh b/encryption/testprotos/generate.sh
index d4a969cf1..523c3986d 100755
--- a/encryption/testprotos/generate.sh
+++ b/encryption/testprotos/generate.sh
@@ -17,7 +17,7 @@ repo_root=$(git rev-parse --show-toplevel)
 . "$repo_root/proto-tools.env"
 
 actual_protoc=$(protoc --version | awk '{print $2}')
-if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+if [[ "$actual_protoc" != "$PROTOC_VERSION" ]]; then
   echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
   echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
   exit 1
diff --git a/flow/proto/generate.sh b/flow/proto/generate.sh
index 314d2aa2b..6a626bb38 100755
--- a/flow/proto/generate.sh
+++ b/flow/proto/generate.sh
@@ -17,7 +17,7 @@ repo_root=$(git rev-parse --show-toplevel)
 . "$repo_root/proto-tools.env"
 
 actual_protoc=$(protoc --version | awk '{print $2}')
-if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+if [[ "$actual_protoc" != "$PROTOC_VERSION" ]]; then
   echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
   echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
   exit 1
diff --git a/shared/management/proto/generate.sh b/shared/management/proto/generate.sh
index 753e5c244..2f8381c1c 100755
--- a/shared/management/proto/generate.sh
+++ b/shared/management/proto/generate.sh
@@ -17,7 +17,7 @@ repo_root=$(git rev-parse --show-toplevel)
 . "$repo_root/proto-tools.env"
 
 actual_protoc=$(protoc --version | awk '{print $2}')
-if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+if [[ "$actual_protoc" != "$PROTOC_VERSION" ]]; then
   echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
   echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
   exit 1
diff --git a/shared/signal/proto/generate.sh b/shared/signal/proto/generate.sh
index 7499adc6f..adf436adc 100755
--- a/shared/signal/proto/generate.sh
+++ b/shared/signal/proto/generate.sh
@@ -17,7 +17,7 @@ repo_root=$(git rev-parse --show-toplevel)
 . "$repo_root/proto-tools.env"
 
 actual_protoc=$(protoc --version | awk '{print $2}')
-if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+if [[ "$actual_protoc" != "$PROTOC_VERSION" ]]; then
   echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
   echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
   exit 1