Skip to content

fix(ci): semantic-audit-check fails closed instead of printing a pass - #53

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/semantic-audit-fail-closed
Oct 7, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
fix/semantic-audit-fail-closed

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

.github/actions/semantic-audit-check/action.yml printed a list of checks and then Semantic Audit Passed unconditionally. It checked nothing. The cicd-squabbler audit --semantic subcommand it names does not exist. It now fails closed: one step emits ::error title=semantic-audit-check::not implemented … and exit 1.

No workflow in this repo calls the action today (git grep semantic-audit-check origin/main -- .github matches only the action itself), so nothing goes red. But the first caller would have gained a gate that cannot fail. Same placeholder in 7 repos; same fix in each. Owner decision (2026-10-07): fail closed here, and do the real squabbling centrally from cicd-squabbler once it ships a pinned artifact. It has none today: no release, no tag, no container package.

Type of change

  • 🐛 Bug fix: a fake pass becomes an honest failure.
  • ✨ New feature: none.
  • 💥 Breaking change: not ticked; nothing calls the action.
  • 🕳️ Soundness fix: removes a gate that could not fail.
  • 📖 Documentation: n/a
  • 🧹 Refactor: n/a
  • ⚡ Performance: n/a
  • 🔧 Build / CI / tooling: one composite action.

📌 New pins

Head SHA: 431d46a. No pins added or changed: no uses:, actions.lock, lockfile or digest is touched.

How has this been verified?

  • yq -o=json . .github/actions/semantic-audit-check/action.yml parses (KYAML content, D280; filename kept because Actions requires action.yml).
  • git diff --stat origin/main: exactly 1 file changed.
  • Caller check: git grep -l semantic-audit-check origin/main -- .github lists no workflow.
  • Commit 431d46a is signed (%G? = G).

Checklist

  • My commits are signed (git commit -S).
  • I ran the project's own checks/tests locally and they pass: not ticked as a test claim. This change touches no code; the check that applies is the parse above.
  • New files carry the correct SPDX-License-Identifier: not ticked. There are no new files; the modified file had no SPDX header before, and adding one is a licence edit left to the owner.
  • Docs are updated, and no public claim now overstates what the code does. The action's name and description now say "not implemented: fails closed".
  • I have not introduced a soundness hole; this PR removes one.

Notes for reviewers

A failing step is the intended behaviour. Wire this action into a workflow only once a real audit exists.

🤖 Generated with Claude Code

https://claude.ai/code/session_015bTuGfwCcvjrmNFejydTML

…pass

The action echoed a list of checks and then "Semantic Audit Passed"
unconditionally. It called nothing; the cicd-squabbler `audit` subcommand
it names does not exist. No workflow calls it yet, but the first caller
would have gained a gate that cannot fail. It now exits 1 with an
explicit not-implemented error until a real audit exists.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015bTuGfwCcvjrmNFejydTML
@coderabbitai

coderabbitai Bot commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 01fc7026-a399-43dc-822c-5dbdb3951d1f
📥 Commits

Reviewing files that changed from the base of the PR and between 8d54585 and 431d46a.

📒 Files selected for processing (1)
  • .github/actions/semantic-audit-check/action.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (6)
  • GitHub Check: scan / gitleaks
  • GitHub Check: call-estate-audit / estate-audit
  • GitHub Check: check
  • GitHub Check: CodeQL Analysis (rust)
  • GitHub Check: CodeQL Analysis (actions)
  • GitHub Check: semgrep-cloud-platform/scan
🔇 Additional comments (1)
.github/actions/semantic-audit-check/action.yml (1)

1-14: LGTM!


📝 Summary

Summary by CodeRabbit

  • Chores
    • The semantic audit check now reports that it is not implemented and fails the gate.

Walkthrough

The semantic audit composite action now identifies itself as unimplemented, prints an error, and exits with status 1 instead of reporting a pass.

Changes

Semantic audit gate

Layer / File(s) Summary
Fail the unimplemented audit
.github/actions/semantic-audit-check/action.yml
The action metadata identifies the gate as unimplemented. Its step prints an error and exits with status 1 instead of reporting a pass.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 431d4

The unimplemented audit no longer reports a pass. No actionable merge blocker remains from the supplied evidence.

Architecture Summary

Architecture risk: 🔵 Low · up to 431d4

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

  • observed — Modified behavior in .github/actions/semantic-audit-check/action.yml: The action metadata now identifies the gate as an unimplemented placeholder. Its step replaces the informational audit messages and unconditional pass output with an error message and exit 1.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly describes the main change: the semantic audit action now fails closed instead of reporting a false pass.
Description check ✅ Passed The description explains the action's previous behaviour, the fail-closed change, and the reason for the change.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit reads the gate’s new sign,
“Not implemented”—clear by design.
No false green light appears today,
The failing status leads the way.
I nibble clover, pleased and bright.

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

sonarqubecloud Bot commented Oct 7, 2026

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath merged commit 32e5567 into main Oct 7, 2026
14 checks passed
@hyperpolymath
hyperpolymath deleted the fix/semantic-audit-fail-closed branch October 7, 2026 15:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant