The only way our GitHub Action went green was when the verifier was missing

Описание и применение

В репозитории TraceFold composite GitHub Action неверно подтверждал выполнение проверок, проходя, когда отсутствовал бинарный проверщик. После исправления действие теперь корректно завершается с ошибкой при отсутствии проверщика и правильно передаёт код выхода проверщика.

Задача

A CI composite GitHub Action claimed to verify execution receipts but actually passed when the verifier binary was missing, violating the fail‑closed design of the project.

Результат

The action now correctly enforces fail‑closed behavior, preventing false positives in CI pipelines.

Рабочий процесс

• Check if gx binary is on PATH
• If missing, print error and exit 1
• If present, run "gx verify-receipts" (or correct subcommand) and propagate exit code

Доказательства

Binary absent: the step now prints an error saying the check cannot pass without the verifier, and exits 1.

Источник

Binary present: the invocation is deliberately unchanged, with a comment stating the known limit, that the subcommand is wrong and even an installed gx fails this step today.

Источник