CoreCI's ValidateShellCommand (internal/runner/validate.go) rejects
invoke: strings containing &|;`><$() — security measure to prevent
shell injection. The previous .coreci.yml jobs had inline invoke:
commands with || redirects and $(date) substitution, causing:
job "gitleaks" failed: shell command contains forbidden metacharacters
Fix: all complex logic moved to scripts/ci-run.sh. Each .coreci.yml job
uses invoke: "sh scripts/ci-run.sh <job-name>" — no metacharacters in
the invoke: string. The script itself can use any shell features
internally (CoreCI only validates the invoke: field, not what the script
does).
---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---
Jon Chery