fix(ci): make s3s footprint ratchet count the tree, not stdin (#6681)

fix(ci): give the s3s footprint ratchet explicit rg paths so CI counts the tree, not stdin

scripts/check_s3s_footprint.sh

@@ -4,10 +4,18 @@
 # acceptance criteria recorded in rustfs/backlog#1733).
 #
 # The migration's goal is to shrink the direct s3s surface, so new code must
-# not grow it. Two counters are ratcheted, baselines verified on 2026-08-05:
+# not grow it. Two counters are ratcheted (verification dates live next to the
+# baseline values below):
 #
-#   - files referencing s3s paths:  rg -l "$S3S_PATH_PATTERN" --type rust (files)
+#   - files referencing s3s paths:  rg -l "$S3S_PATH_PATTERN" --type rust . (files)
-#   - s3_error! invocation lines:   rg -c 's3_error!' --type rust    (summed)
+#   - s3_error! invocation lines:   rg -c 's3_error!' --type rust .   (summed)
+#
+# Every rg invocation MUST pass an explicit path ('.' for repo-wide): without
+# one, rg searches stdin instead of the tree whenever stdin is a readable
+# pipe — which is exactly what GitHub Actions attaches to run steps — and
+# silently counts 0 (observed on run 32978746357, where both repo-wide
+# counters read 0 and were waved through as "shrank"). The sanity assertions
+# below fail hard if that ever regresses.
 #
 # Either count exceeding its baseline fails the check with the offending
 # delta. Baselines are LOWER-ONLY: when a PR shrinks the footprint, lower the
@@ -22,10 +30,15 @@ set -euo pipefail
 
 cd "$(dirname "$0")/.."
 
-# Baselines verified on 2026-08-11. Lower-only; see header.
+# Baselines verified on 2026-08-26. Lower-only; see header.
 # Excludes crates/e2e_test/ — test infrastructure legitimately uses s3s
 # to verify S3 behavior and does not widen the production s3s surface.
-S3S_IMPORT_FILES_BASELINE=208
+# 208 → 215 on 2026-08-26: PR #6670 mechanically split
+# rustfs/src/app/object_usecase.rs into 8 per-operation modules (net +7
+# files, zero new s3s code — the same handler-layer surface redistributed).
+# The file counter is split-sensitive; the s3_error! line counter confirms
+# no growth (unchanged at 1620).
+S3S_IMPORT_FILES_BASELINE=215
 S3_ERROR_LINES_BASELINE=1620
 # ecstore-scoped ratchet (rustfs/backlog#1842): the storage engine must not
 # know S3 wire/DTO types (ARCHITECTURE.md invariant 4). The S3-*consuming*
@@ -51,8 +64,9 @@ run_rg_to() {
     fi
 }
 
-run_rg_to "$TMP_DIR/import_files" -l "$S3S_PATH_PATTERN" --type rust $E2E_TEST_GLOB
+# Explicit '.' path is load-bearing — see header. Never drop it.
-run_rg_to "$TMP_DIR/error_lines" -c 's3_error!' --type rust $E2E_TEST_GLOB
+run_rg_to "$TMP_DIR/import_files" -l "$S3S_PATH_PATTERN" --type rust "$E2E_TEST_GLOB" .
+run_rg_to "$TMP_DIR/error_lines" -c 's3_error!' --type rust "$E2E_TEST_GLOB" .
 run_rg_to "$TMP_DIR/ecstore_files" -l "$S3S_PATH_PATTERN" --type rust crates/ecstore/src
 
 s3s_import_files="$(grep -c . "$TMP_DIR/import_files" || true)"
@@ -66,6 +80,28 @@ for value in "$s3s_import_files" "$s3_error_lines" "$s3s_ecstore_files"; do
     fi
 done
 
+# Sanity assertions: a counter reading 0 while its baseline is positive, or
+# the repo-wide file count dropping below the ecstore-scoped one (a strict
+# subset of it), means the counter itself broke — most likely rg searching
+# stdin instead of the tree (see header) — not that the footprint shrank.
+# Fail hard rather than waving the ratchet through. If the footprint ever
+# genuinely reaches zero, lower the baseline to 0 in the same PR.
+sanity_nonzero() {
+    local label="$1" count="$2" baseline="$3"
+    if ((count == 0 && baseline > 0)); then
+        echo "error: $label counted 0 with a baseline of $baseline — the counter is" >&2
+        echo "  broken (rg likely searched stdin; every rg call needs an explicit path)." >&2
+        exit 1
+    fi
+}
+sanity_nonzero "files importing s3s" "$s3s_import_files" "$S3S_IMPORT_FILES_BASELINE"
+sanity_nonzero "s3_error! invocation lines" "$s3_error_lines" "$S3_ERROR_LINES_BASELINE"
+if ((s3s_import_files < s3s_ecstore_files)); then
+    echo "error: repo-wide s3s file count ($s3s_import_files) is below the ecstore-scoped" >&2
+    echo "  count ($s3s_ecstore_files); the repo-wide counter is broken (see header)." >&2
+    exit 1
+fi
+
 status=0
 
 check_ratchet() {
@@ -87,9 +123,9 @@ check_ratchet() {
 }
 
 check_ratchet "files importing s3s" "$s3s_import_files" "$S3S_IMPORT_FILES_BASELINE" \
-    "rg -l '$S3S_PATH_PATTERN' --type rust $E2E_TEST_GLOB"
+    "rg -l '$S3S_PATH_PATTERN' --type rust $E2E_TEST_GLOB ."
 check_ratchet "s3_error! invocation lines" "$s3_error_lines" "$S3_ERROR_LINES_BASELINE" \
-    "rg -c 's3_error!' --type rust $E2E_TEST_GLOB"
+    "rg -c 's3_error!' --type rust $E2E_TEST_GLOB ."
 check_ratchet "ecstore files referencing s3s" "$s3s_ecstore_files" "$S3S_ECSTORE_FILES_BASELINE" \
     "rg -l '$S3S_PATH_PATTERN' --type rust crates/ecstore/src"