The only way our GitHub Action went green was when the verifier was missing

说明与用途

在 TraceFold 仓库中，一个 composite GitHub Action 在缺少验证器二进制文件时错误地通过了。修复后，该 Action 在缺少验证器时会报错，并正确传递验证器的退出码。

问题

A CI composite GitHub Action claimed to verify execution receipts but actually passed when the verifier binary was missing, violating the fail‑closed design of the project.

结果

The action now correctly enforces fail‑closed behavior, preventing false positives in CI pipelines.

工作流

• Check if gx binary is on PATH
• If missing, print error and exit 1
• If present, run "gx verify-receipts" (or correct subcommand) and propagate exit code

证据

Binary absent: the step now prints an error saying the check cannot pass without the verifier, and exits 1.

来源

Binary present: the invocation is deliberately unchanged, with a comment stating the known limit, that the subcommand is wrong and even an installed gx fails this step today.

来源