fix: org-gate C1 求值 bash -e false 灭脚本缺陷（ADR-0046）

[randypanding]

agent-registry PR#65 实测：VERDICT=$(jq -e ...) 对 false 结论退出 1，裸赋值后取 $? 在 Actions 默认 bash -e 下直接灭脚本（非 C1 PR 静默 exit 1 无任何输出）。改 RC=0; VERDICT=$(...) || RC=$?——false 是合法求值结果，只有 RC>1（编译/求值错误）才 fail-closed 判红。

Summary by CodeRabbit

• Bug Fixes
  • 修复 C1 路径判定流程，避免非 C1 结果导致检查意外中止。
  • 保留对编译或求值错误的严格失败处理，提升流程判断的稳定性。

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e839ef12-840d-4368-a737-5e01042483f0

📥 Commits

Reviewing files that changed from the base of the PR and between 8c2ddc8 and f999e43.

📒 Files selected for processing (1)

• .github/workflows/org-gate.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

本次变更更新 org-gate.yml 中的 C1 路径判定。脚本显式捕获 jq -e 的退出状态，区分正常的 false 结果与执行或求值错误。

Changes

C1 路径判定

Layer / File(s)	Summary
显式处理 jq -e 退出状态 .github/workflows/org-gate.yml	脚本保存 jq -e 生成的 VERDICT 和退出码 RC。非 C1 的 false 结果不会在 Bash -e 下直接终止脚本。编译或求值错误仍进入 fail-closed 分支。

Possibly related PRs

• Cloudbird-Software/CI-Workflows#25：同样修改 .github/workflows/org-gate.yml 中 C1 路径检查的 jq 退出状态处理。

Suggested labels: security, bug

Merge Risk: ⚪ Minimal · up to f999e

The workflow now preserves valid false evaluations instead of terminating early; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	标题使用了有效的 Conventional Commits fix: 前缀，长度为 49 个字符，并准确描述了 C1 求值缺陷修复。

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch p3-1-verdict-fix

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Prevent org-gate exits on valid non-C1 verdicts

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Capture jq -e exit status without triggering GitHub Actions’ bash -e behavior.
• Treat false as valid while preserving fail-closed handling for evaluation errors.

Diagram

graph TD
  A["PR files page"] --> B["jq C1 verdict"] --> C{"Exit status"}
  C -->|"0 / true"| D["Mark C1"]
  C -->|"1 / false"| E["Continue non-C1"]
  C -->|">1 / error"| F["Fail closed"]

Loading

High-Level Assessment

The explicit RC=0; VERDICT=$(...) || RC=$? approach is appropriately surgical: it makes jq’s three outcome classes visible, avoids bash -e termination for valid false results, and retains fail-closed behavior for real errors. Conditional execution or temporarily disabling errexit would be less explicit and easier to misuse.

Files changed (1) +5 / -3

Bug fix (1) +5 / -3

org-gate.ymlSafely capture false C1 verdicts under Bash errexit +5/-3

Safely capture false C1 verdicts under Bash errexit

• Initializes the jq result code and captures nonzero status through an OR-list, preventing 'bash -e' from terminating valid non-C1 evaluations. Exit code 1 remains a legal false verdict, while statuses above 1 still fail closed as evaluation errors.

.github/workflows/org-gate.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can copy the agent prompt from any finding and feed it to your IDE agent

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗