From 2ab036d4c0c4e48a1ab7e972630d5b34e46e6639 Mon Sep 17 00:00:00 2001 From: lukasWuttke <54042461+LukasWodka@users.noreply.github.com> Date: Tue, 11 Aug 2026 09:09:02 +0200 Subject: [PATCH] =?UTF-8?q?fix(ci):=20arm=20code-quality=20=E2=80=94=20git?= =?UTF-8?q?leaks=20was=20a=20required=20check=20that=20could=20not=20fail?= =?UTF-8?q?=20(backend#1681)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `soft-fail` was left at its default of true, so every code-quality job in this repo reported findings and then exited 0 — including the credential scan. On this repo gitleaks and house-rules are REQUIRED status checks, so they were required checks incapable of failing. backend#1303 ("flip code-quality to required per repo once its backlog is clean"), which the deferring comment pointed at, closed 2026-07-31. Measured the most recent run on this repo before flipping: zero real findings for gitleaks, house-rules and action-pins (the only annotations are GitHub's Node-20 deprecation notice). So this arms a green check rather than importing a backlog. Also corrects the comment claiming the pin check is "Independent of soft-fail above" — there was no soft-fail above. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/code-quality-caller.yml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/.github/workflows/code-quality-caller.yml b/.github/workflows/code-quality-caller.yml index 2814105..0cb7e6c 100644 --- a/.github/workflows/code-quality-caller.yml +++ b/.github/workflows/code-quality-caller.yml @@ -21,10 +21,19 @@ jobs: # Armed 2026-08-06 (backend#1492). Measured zero pin violations on every # develop branch first, so this makes a green check stay green rather than # importing a backlog. Soft-fail let #1449 add a second unpinned call site - # of an action while #1446 was open to pin it. Independent of soft-fail - # above: this repo's other jobs keep whatever posture they have. + # of an action while #1446 was open to pin it. Both this and `soft-fail` + # below are now false, so the pin check is armed either way. action-pins: true action-pins-soft-fail: false # gitleaks + house-rules run by default -- these are docs' real content gates - # (backend#1420, off-train gates-only). soft-fail left default (advisory) until - # a first green run is observed; arm required on main afterward. \ No newline at end of file + # (backend#1420, off-train gates-only). soft-fail is armed below + # (backend#1681); required-on-main remains a separate decision. + # ARMED 2026-08-11 (backend#1681). Until now `soft-fail` was left at its + # default of TRUE, so every job here -- including the credential scan -- + # reported findings and then exited 0. On this repo gitleaks and + # house-rules are REQUIRED status checks, i.e. required checks that could + # not fail. backend#1303 ("flip code-quality to required per repo once its + # backlog is clean") closed 2026-07-31, and the most recent run reports + # zero real findings for gitleaks, house-rules and action-pins -- so this + # arms a green check rather than importing a backlog. + soft-fail: false