Strip comments where every name arrives, not at one source

The previous commit stripped base-domains and stopped there. The next run on a
real host died the same way, on a bare `#` from a repository's own declaration:
a fetched body was cat'd raw too, so the bug was the same one a layer over, and
fixing the source I happened to be looking at left the other one open.

There is one place every name arrives, and comments are stripped there now.
Both sources reach it, and so will any source added later. A domain cannot
contain `#`, so nothing legitimate is lost.

The per-repository count was of lines, so a comment block counted as declared
names: "15 name(s) declared" for a file declaring rather fewer. It counts names.

The bare `#` is not an odd thing to write. It is the separator line in a
comment block, which is how the generated files in these repositories are
written, so the first project to document its own declaration would have hit
this whatever else it contained.

bin/dejima-ci-allowlist

@@ -207,7 +207,7 @@ fetch_repo() {
     # Now every consulted repository says what it gave, and the one that is
     # missing is missing from a list rather than from the operator's memory.
     case "$http" in
-        200) say "  $repo: $(grep -c . "$body" || true) name(s) declared"
+        200) say "  $repo: $(sed 's/#.*//' "$body" | grep -c '[^[:space:]]' || true) name(s) declared"
              cat "$body" ;;
         404) say "  $repo: no .dejima/allowed-domains on ${CFG[ref]}" ;;
         # 401 and 403 are the two an operator will actually meet, and they mean
@@ -309,7 +309,14 @@ render() {
     # pipefail - grep exits 1 on no matches - and they send whoever reads it
     # to entirely different places.
     raw=$(collect) || die "collection failed; leaving the existing allowlist in place"
-    domains=$(printf '%s\n' "$raw" | tr -d '\r' | tr -d '[:blank:]' | grep -v '^$' | sort -u || true)
+    # COMMENTS STRIPPED HERE, over everything, rather than at each source. The
+    # first attempt at this stripped base-domains only, and the very next run
+    # died on a `#` from a repository's own declaration - the same bug one
+    # layer over, because a fetched body was cat'd raw too. There is one place
+    # every name arrives, and this is it. A domain cannot contain `#`, so
+    # nothing legitimate is lost.
+    domains=$(printf '%s\n' "$raw" | sed 's/#.*//' \
+        | tr -d '\r' | tr -d '[:blank:]' | grep -v '^$' | sort -u || true)
 
     # An empty render is refused rather than installed. This is the failure
     # direction that matters: an allowlist of nothing looks identical to a

test/allowlist.bats

@@ -501,3 +501,36 @@ run_tool() { run "$BIN" "$@" --config "$T/config"; }
     [ "$status" -eq 0 ]
     grep -qx acme/two "$T/repos"
 }
+
+@test "a comment in a repository's declaration is a comment too" {
+    # The first fix stripped base-domains and nothing else, and the very next
+    # run on a real host died on a bare `#` from a repository's own
+    # declaration. A fetched body was cat'd raw, so the bug was the same one a
+    # layer over. Both arrive at one place now, and that is where stripping
+    # happens.
+    mkdir -p "$STUB_DIR/owner"
+    printf '# what this project needs\n#\n# and why\nreal.example.com\n' > "$STUB_DIR/owner/repo.body"
+    run_tool render
+    [ "$status" -eq 0 ]
+    grep -q '^server=/real.example.com/' "$T/out/ci-allow.conf"
+    [ "$(grep -c '^server=' "$T/out/ci-allow.conf")" -eq 1 ]
+}
+
+@test "a bare hash line does not become an entry" {
+    # Exactly what a real host produced: `refusing a malformed entry: #`. A
+    # separator line in a comment block, which is how this organisation's own
+    # generated files are written.
+    mkdir -p "$STUB_DIR/owner"
+    printf '#\nreal.example.com\n' > "$STUB_DIR/owner/repo.body"
+    run_tool render
+    [ "$status" -eq 0 ]
+}
+
+@test "the declared count is names, not lines" {
+    # A comment block counted as declared names, so a repository reporting
+    # "15 name(s) declared" might be declaring rather fewer.
+    mkdir -p "$STUB_DIR/owner"
+    printf '# three comment lines\n#\n# here\none.example.com\ntwo.example.com\n' > "$STUB_DIR/owner/repo.body"
+    run_tool render
+    [[ "$output" == *"owner/repo: 2 name(s) declared"* ]]
+}