Test: Harden manifest validation

tests/setup/contract-manifest-contract

@@ -21,7 +21,7 @@ discover_contracts() {
 validate_manifest() {
     local candidate="$1"
     local -n expected_contracts="$2"
-    local line capabilities path extra previous_was_comment=0
+    local line capabilities path extra previous_comment="" previous_was_comment=0
     local -a capability_list=()
     local -A manifest_paths=() capability_counts=()
     local previous_path=""
@@ -31,11 +31,15 @@ validate_manifest() {
 
     while IFS= read -r line || [[ -n "$line" ]]; do
         if [[ "$line" =~ ^[[:space:]]*# ]]; then
+            previous_comment="${line#*#}"
+            previous_comment="${previous_comment#"${previous_comment%%[![:space:]]*}"}"
+            previous_comment="${previous_comment%"${previous_comment##*[![:space:]]}"}"
             previous_was_comment=1
             continue
         fi
 
         if [[ "$line" =~ ^[[:space:]]*$ ]]; then
+            previous_comment=""
             previous_was_comment=0
             continue
         fi
@@ -43,6 +47,7 @@ validate_manifest() {
         IFS=$' \t' read -r capabilities path extra <<<"$line"
         if [[ -z "${capabilities:-}" || -z "${path:-}" || -n "${extra:-}" ]]; then
             validation_note "manifest line is not exactly two fields: $line"
+            previous_comment=""
             previous_was_comment=0
             continue
         fi
@@ -81,9 +86,14 @@ validate_manifest() {
             validation_note "hermetic must appear alone on $path"
         fi
 
-        if [[ "$capabilities" != hermetic && "$previous_was_comment" -ne 1 ]]; then
-            validation_note "$path is non-hermetic but lacks a directly preceding comment"
+        if [[ "$capabilities" != hermetic ]]; then
+            if [[ "$previous_was_comment" -ne 1 ]]; then
+                validation_note "$path is non-hermetic but lacks a directly preceding comment"
+            elif [[ -z "$previous_comment" ]]; then
+                validation_note "$path is non-hermetic but lacks a non-empty directly preceding comment"
+            fi
         fi
+        previous_comment=""
         previous_was_comment=0
     done < "$candidate"
 
@@ -108,8 +118,12 @@ validate_manifest() {
     return 0
 }
 
+cleanup_fixture() {
+    [[ -n "${fixture:-}" ]] && rm -f -- "$fixture"
+}
+
 run_parser_fixture() {
-    local label="$1" expected_message="$2" contents="$3" output fixture
+    local label="$1" expected_message="$2" contents="$3" output fixture=""
     shift 3
     local -A fixture_paths=()
     local fixture_path
@@ -118,13 +132,18 @@ run_parser_fixture() {
     done
 
     fixture="$(mktemp)"
+    trap cleanup_fixture EXIT
+    trap 'cleanup_fixture; exit 130' INT
+    trap 'cleanup_fixture; exit 143' TERM
     printf '%s' "$contents" > "$fixture"
     if output="$(validate_manifest "$fixture" fixture_paths 2>&1)"; then
         printf 'contract manifest: parser fixture %s unexpectedly passed\n' "$label" >&2
-        rm -f "$fixture"
+        cleanup_fixture
+        trap - EXIT INT TERM
         return 1
     fi
-    rm -f "$fixture"
+    cleanup_fixture
+    trap - EXIT INT TERM
 
     if ! grep -Fq "$expected_message" <<<"$output"; then
         printf 'contract manifest: parser fixture %s did not name %q: %s\n' \
@@ -149,6 +168,9 @@ run_parser_fixtures() {
     run_parser_fixture uncommented-non-hermetic \
         'tests/a is non-hermetic but lacks a directly preceding comment' \
         $'network tests/a\n' tests/a || return 1
+    run_parser_fixture blank-comment \
+        'tests/a is non-hermetic but lacks a non-empty directly preceding comment' \
+        $'#\nnetwork tests/a\n' tests/a || return 1
 }
 
 [[ -r "$manifest" ]] || {