fix(code-quality): make the per-job soft-fail overrides able to override (backend#1681)

[LukasWodka]

What

action-pins-soft-fail and format-soft-fail were OR-ed with the global soft-fail:

SOFT_FAIL: ${{ (inputs.soft-fail || inputs.action-pins-soft-fail) && 'true' || 'false' }}

soft-fail defaults to true, so the per-job override could only ever make a job more advisory — it could never arm one. That inverts its purpose: the input is separate precisely so a repo can arm the supply-chain check while the rest of its suite stays advisory during a migration.

Why it matters

Measured on origin/develop: 16 of 16 callers pass action-pins-soft-fail: false. Four of them — docs, model-zoo, start-training, tracebloc-website — pass no soft-fail at all, yet carry this comment:

Armed 2026-08-06 (backend#1492) … Independent of soft-fail above

There is no soft-fail "above" in those four files. So action-pins has been advisory in exactly the four repos that believe it is armed, and three of those are public. (tracebloc-website's caller even has # soft-fail: false # flip once the backlog is clear (#1303) commented out two lines below the "Armed" claim.)

Note this contradicts the old inline comment, which described the OR as deliberate ("both must be false"). Under those semantics the input is inert by construction — every caller passes false expecting it to strengthen, never to weaken. I've taken the callers' intent as authoritative and rewritten the comment to match.

Effect

case	before	after	changed
12 repos passing both false	armed	armed	no
4 repos: soft-fail default, action-pins-soft-fail: false	advisory	armed	YES
new repo passing nothing	advisory	advisory	no
repo with soft-fail: false, override defaulted	advisory	advisory	no

Only the intended row moves. format-soft-fail gets the identical fix and is behaviour-neutral today — no caller passes it and its default is true — so it removes the same trap before it springs.

Test plan / evidence

• Arming is safe, verified before shipping. I rebuilt this job's own scanner byte-faithfully (same USES/SHA_PIN/TB_MAIN/DOCKER_DIGEST regexes, same comment-stripping) and mutation-tested it: on clean input → 0 findings; on injected @v4, a SHA-pinned tracebloc/* ref, and an expression ref → 3 findings with the correct reasons; commented-out lines correctly skipped. Result across all 16 repos: 0 unpinned refs, so no PR turns red on merge.
• python3 -c "yaml.safe_load(...)" → valid.
• actionlint .github/workflows/code-quality.yml → clean.

Found by the round-2 pipeline audit, backend#1681. Parent epic: backend#1680.

---

Note

Medium Risk
Changes CI gating for action-pins fleet-wide (four repos flip from advisory to blocking), but intended and verified clean on unpinned refs; wrong logic would have been worse for supply-chain enforcement.

Overview
Fixes action-pins so action-pins-soft-fail: false actually makes unpinned workflow refs fail the job instead of staying advisory whenever global soft-fail defaults to true.

SOFT_FAIL for action-pins no longer ORs in inputs.soft-fail; only action-pins-soft-fail sets posture. That matches callers that arm the supply-chain check while the rest of the suite is still migration-advisory—four repos that believed the gate was “armed independent of soft-fail” were not.

The format (black) job keeps (soft-fail || format-soft-fail) with new comments: format’s override is additive/advisory by contract, so removing the OR would hard-gate every default soft-fail: true adopter. No runtime behavior change for format today.

^{Reviewed by Cursor Bugbot for commit 9fd9994. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

Fixed — reverted the format job to the additive (inputs.soft-fail || inputs.format-soft-fail). You're right: format-soft-fail defaults to false and its contract is "advisory even when soft-fail is false" (additive), so dropping the OR turned every soft-fail: true caller's format job into a hard gate. Left the action-pins job authoritative — that's the one 16 callers arm with action-pins-soft-fail: false, which is what backend#1681 is actually about.

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9fd9994. Configure here.}