From bc8f4f66925bbec464fe8fa56f6a22df2017cbba Mon Sep 17 00:00:00 2001
From: Amit Kumar <ak.nitrr13@gmail.com>
Date: Sat, 1 Aug 2026 16:24:53 +0000
Subject: [PATCH] fix: resolve Sonar defects

---
 scripts/ci/test_ci_monitor.cjs |  8 ++++++++
 scripts/ci_monitor.cjs         | 17 +++++++++++++----
 src/lib/outbox.ts              |  2 +-
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/scripts/ci/test_ci_monitor.cjs b/scripts/ci/test_ci_monitor.cjs
index 7755553..e569ac5 100644
--- a/scripts/ci/test_ci_monitor.cjs
+++ b/scripts/ci/test_ci_monitor.cjs
@@ -30,6 +30,14 @@ result = run(['runs', '--repo', 'RandomCodeSpace/kb', '--branch', 'main', '--lim
 assert.equal(result.status, 0, result.stderr);
 assert.deepEqual(readFileSync(log, 'utf8').trim().split('\n'), ['run', 'list', '--limit', '5', '--branch', 'main', '-R', 'RandomCodeSpace/kb']);
 
+result = run(['runs', '--repo', 'RandomCodeSpace/kb'], { CI_MONITOR_GH: 'gh' });
+assert.equal(result.status, 2);
+assert.match(result.stderr, /CI_MONITOR_GH must be an absolute path/);
+
+result = run(['runs'], { CI_MONITOR_GIT: 'git', GITHUB_REPOSITORY: '' });
+assert.equal(result.status, 2);
+assert.match(result.stderr, /CI_MONITOR_GIT must be an absolute path/);
+
 result = run(['check-actions']);
 assert.equal(result.status, 0, result.stderr);
 assert.match(result.stdout, /immutable SHAs/);
diff --git a/scripts/ci_monitor.cjs b/scripts/ci_monitor.cjs
index 5f7a787..fa4a686 100644
--- a/scripts/ci_monitor.cjs
+++ b/scripts/ci_monitor.cjs
@@ -5,7 +5,7 @@
 
 const { execFileSync, spawnSync } = require('node:child_process');
 const { existsSync, readFileSync, readdirSync } = require('node:fs');
-const { join } = require('node:path');
+const { isAbsolute, join } = require('node:path');
 
 const HELP = `usage: node scripts/ci_monitor.cjs <command> [arguments]
 
@@ -28,6 +28,12 @@ function die(message) {
   process.exit(2);
 }
 
+function executable(envName, fallback) {
+  const value = process.env[envName] || fallback;
+  if (!isAbsolute(value)) die(`${envName} must be an absolute path`);
+  return value;
+}
+
 function extractOption(args, name, fallback) {
   const index = args.indexOf(name);
   if (index < 0) return fallback;
@@ -45,7 +51,11 @@ function repository(args) {
   }
   let remote;
   try {
-    remote = execFileSync('git', ['remote', 'get-url', 'origin'], { encoding: 'utf8' }).trim();
+    remote = execFileSync(
+      executable('CI_MONITOR_GIT', '/usr/bin/git'),
+      ['remote', 'get-url', 'origin'],
+      { encoding: 'utf8' },
+    ).trim();
   } catch {
     die('cannot detect repository; pass --repo OWNER/REPO');
   }
@@ -55,8 +65,7 @@ function repository(args) {
 }
 
 function gh(repo, args, capture = false) {
-  const executable = process.env.CI_MONITOR_GH || 'gh';
-  const result = spawnSync(executable, [...args, '-R', repo], {
+  const result = spawnSync(executable('CI_MONITOR_GH', '/usr/bin/gh'), [...args, '-R', repo], {
     encoding: 'utf8',
     stdio: capture ? ['ignore', 'pipe', 'pipe'] : 'inherit',
   });
diff --git a/src/lib/outbox.ts b/src/lib/outbox.ts
index 643a74d..0212d99 100644
--- a/src/lib/outbox.ts
+++ b/src/lib/outbox.ts
@@ -375,7 +375,7 @@ export class MetadataOutbox {
       const key = this.storage.key(i);
       if (key && namespaceStorageSuffix(PREFIX, this.ns, key) !== null) keys.push(key);
     }
-    return keys.sort();
+    return keys.sort((left, right) => left.localeCompare(right));
   }
 
   private async locked<T>(fn: () => T | Promise<T>): Promise<T | undefined> {