Wrapper tool hardening and cleanup

internal/pipeline/build.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -655,14 +656,15 @@ func referencedScriptResrefs(p *project.Project) ([]string, error) {
 }
 
 func resolveScriptCompiler(p *project.Project) (string, error) {
+	candidates := make([]string, 0, 2+len(p.ScriptCompilerSearchPaths()))
 	if configured := p.ScriptCompilerPath(); configured != "" {
-		return configured, nil
+		candidates = append(candidates, configured)
 	}
 	if configured := strings.TrimSpace(os.Getenv(p.ScriptCompilerPathEnv())); configured != "" {
-		return configured, nil
+		candidates = append(candidates, configured)
 	}
+	candidates = append(candidates, p.ScriptCompilerSearchPaths()...)
 
-	candidates := p.ScriptCompilerSearchPaths()
 	if runtime.GOOS == "windows" {
 		slices.SortStableFunc(candidates, func(a, b string) int {
 			aExe := strings.HasSuffix(strings.ToLower(a), ".exe")
@@ -678,12 +680,12 @@ func resolveScriptCompiler(p *project.Project) (string, error) {
 	}
 	for _, candidate := range candidates {
 		if binary, ok := strings.CutPrefix(candidate, "PATH:"); ok {
-			if compiler, err := exec.LookPath(binary); err == nil {
+			if compiler, err := exec.LookPath(binary); err == nil && scriptCompilerRunnable(compiler) {
 				return compiler, nil
 			}
 			continue
 		}
-		if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
+		if info, err := os.Stat(candidate); err == nil && !info.IsDir() && scriptCompilerRunnable(candidate) {
 			return candidate, nil
 		}
 	}
@@ -691,6 +693,20 @@ func resolveScriptCompiler(p *project.Project) (string, error) {
 	return "", fmt.Errorf("script compiler not found; configure scripts.compiler.path or set %s", p.ScriptCompilerPathEnv())
 }
 
+func scriptCompilerRunnable(path string) bool {
+	if strings.TrimSpace(path) == "" {
+		return false
+	}
+	info, err := os.Stat(path)
+	if err != nil || info.IsDir() {
+		return false
+	}
+	cmd := exec.Command(path, "--help")
+	cmd.Stdout = io.Discard
+	cmd.Stderr = io.Discard
+	return cmd.Run() == nil
+}
+
 func validatorLoadDocument(path string) (gff.Document, string, string, error) {
 	raw, err := os.ReadFile(path)
 	if err != nil {

internal/pipeline/pipeline_test.go

@@ -1031,6 +1031,9 @@ func TestBuildModuleCompilesReferencedScripts(t *testing.T) {
 	compiler := filepath.Join(root, "fake-compiler.sh")
 	mustWriteFile(t, compiler, `#!/bin/sh
 set -eu
+if [ "${1:-}" = "--help" ]; then
+  exit 0
+fi
 out=""
 src=""
 while [ "$#" -gt 0 ]; do