The only way our GitHub Action went green was when the verifier was missing

Description and use

In the TraceFold repo, a composite GitHub Action falsely passed when the verifier binary was missing. After fixing, the action now errors when the verifier is absent and correctly propagates the verifier’s exit code.

Problem

A CI composite GitHub Action claimed to verify execution receipts but actually passed when the verifier binary was missing, violating the fail‑closed design of the project.

Outcome

The action now correctly enforces fail‑closed behavior, preventing false positives in CI pipelines.

Workflow

• Check if gx binary is on PATH
• If missing, print error and exit 1
• If present, run "gx verify-receipts" (or correct subcommand) and propagate exit code

Evidence

Binary absent: the step now prints an error saying the check cannot pass without the verifier, and exits 1.

Source

Binary present: the invocation is deliberately unchanged, with a comment stating the known limit, that the subcommand is wrong and even an installed gx fails this step today.

Source