fix(#2247): compare decoded text in shim drift detection

internal/scaffold/fullsend-repo/scripts/reconcile-repos-test.sh

@@ -140,3 +140,45 @@ if grep -q "contents/.github/workflows/fullsend.yaml.*--method PUT" "${GH_LOG}";
 fi
 
 echo "PASS: stale shim branch update is atomic"
+
+# ===========================
+# Test: identical content with different trailing newlines is not flagged as stale
+# ===========================
+# Regression test for issue #2247: the old base64 comparison produced
+# false-positive drift detection when content was logically identical but
+# encoded with different trailing newlines (GitHub content API quirk).
+
+rm -f "${GH_LOG}"
+
+IDENTICAL_MANAGED=$(cat "${CONFIG_DIR}/templates/shim-workflow-call.yaml")
+IDENTICAL_REMOTE=$(printf '%s\n\n' "$IDENTICAL_MANAGED")
+IDENTICAL_B64=$(printf '%s' "$IDENTICAL_REMOTE" | /usr/bin/base64 | tr -d '\r\n')
+
+cat > "${MOCK_BIN}/gh" <<'EOFTEST'
+#!/usr/bin/env bash
+set -euo pipefail
+if [[ "$1" == "api" ]]; then
+  case "$2" in
+    repos/test-org/test-repo/contents/.github/workflows/fullsend.yaml)
+      jq_filter=""
+      for a in "$@"; do [[ "$prev" == "--jq" ]] && jq_filter="$a"; prev="$a"; done
+      json="{\"content\":\"${IDENTICAL_B64}\",\"sha\":\"file-sha\"}"
+      if [[ -n "$jq_filter" ]]; then printf '%s' "$json" | jq -r "$jq_filter"; else printf '%s\n' "$json"; fi
+      ;;
+    repos/test-org/test-repo) echo '{"default_branch":"main","private":false}' ;;
+  esac
+fi
+EOFTEST
+chmod +x "${MOCK_BIN}/gh"
+# Inject the base64 value into the mock script.
+sed -i'' "s|\${IDENTICAL_B64}|${IDENTICAL_B64}|g" "${MOCK_BIN}/gh"
+
+bash "${RECONCILE_SCRIPT}" "${CONFIG_DIR}" > "${TMPDIR}/stdout-newline.log" 2>&1 || true
+
+if grep -q "shim is stale" "${TMPDIR}/stdout-newline.log"; then
+  echo "FAIL: identical content with different trailing newline was flagged as stale"
+  cat "${TMPDIR}/stdout-newline.log"
+  exit 1
+fi
+
+echo "PASS: identical content with different trailing newlines not flagged as stale"

internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh

@@ -264,7 +264,12 @@ if [ -n "$ENABLED_REPOS" ]; then
       EXPECTED_B64=$(shim_content_b64)
       # GitHub returns base64 with newlines; strip them for comparison.
       REMOTE_B64=$(printf '%s' "$REMOTE_CONTENT" | tr -d '\r\n')
-      if [ "$REMOTE_B64" = "$EXPECTED_B64" ]; then
+      # Compare decoded text instead of re-encoded base64 to avoid
+      # false-positive drift detection from encoding differences
+      # (trailing newlines, line wrapping in command substitution).
+      EXPECTED_DECODED=$(printf '%s' "$EXPECTED_B64" | base64 -d | tr -d '\r')
+      REMOTE_DECODED=$(printf '%s' "$REMOTE_B64" | base64 -d | tr -d '\r')
+      if [ "$REMOTE_DECODED" = "$EXPECTED_DECODED" ]; then
         echo "✓ $REPO already enrolled (shim up to date)"
         SKIPPED=$((SKIPPED + 1))
         continue

qf-tests/GH-8/README.md

@@ -0,0 +1,8 @@
+# QualityFlow Tests — GH-8
+
+Generated by the QualityFlow pipeline.
+
+| Directory | Type | Framework | Destination repo |
+|-----------|------|-----------|-----------------|
+| `go/` | Tier 1 (functional) | Go/Ginkgo | `guyoron1/fullsend` |
+| `python/` | Tier 2 (E2E) | Python/pytest | `guyoron1/fullsend` |