From 0f75fa29ca28adb9904d4436ad2ab171abcfc8bc Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Wed, 26 Aug 2026 00:06:47 -0500 Subject: [PATCH] fix(ci): call spec-immutability.sh directly in gate (make masks exit 3 as 2) `make -C ci spec-immutability || [ $? -eq 3 ]` fails on the honest skip: GNU make exits 2 when the recipe exits 3, so the guard never matches. Invoke the script directly so the exit-3 skip (spec repo not checked out in CI) is tolerated while a real spec drift (exit 1) still blocks. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/gate.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/gate.yml b/.gitea/workflows/gate.yml index 442a575..5a3bf1d 100644 --- a/.gitea/workflows/gate.yml +++ b/.gitea/workflows/gate.yml @@ -50,8 +50,12 @@ jobs: # CI here (it is a separate repo; SPEC_REPO_SLUG is not wired into this runner), so # the guard honestly SKIPS (exit 3) rather than faking green. A real drift/edit of a # co-located spec would exit 1 and fail. Tolerated: exit 3 only. + # Call the script DIRECTLY, not via `make`: GNU make masks a recipe's exit code as + # its own 2 on failure, so `make spec-immutability || [ $? -eq 3 ]` would see 2 and + # fail. The script itself exits 3 on an honest skip (spec repo not checked out here), + # which we tolerate; a real drift/edit exits 1 and fails the gate. - name: Spec immutability (R-TEST-06, skips if spec repo absent) - run: make -C ci spec-immutability || [ "$?" -eq 3 ] + run: ./ci/spec-immutability.sh || [ "$?" -eq 3 ] - name: Static gate — lint + Kyverno L0 + L1 render run: make -C ci lint l0 l1