fix(ci): semantic-audit-check fails closed instead of printing a pass

[hyperpolymath]

Summary

.github/actions/semantic-audit-check/action.yml printed a list of checks and then Semantic Audit Passed unconditionally. It checked nothing. The cicd-squabbler audit --semantic subcommand it names does not exist. It now fails closed: one step emits ::error title=semantic-audit-check::not implemented … and exit 1.

No workflow in this repo calls the action today (git grep semantic-audit-check origin/main -- .github matches only the action itself), so nothing goes red. But the first caller would have gained a gate that cannot fail. Same placeholder in 7 repos; same fix in each. Owner decision (2026-10-07): fail closed here, and do the real squabbling centrally from cicd-squabbler once it ships a pinned artifact. It has none today: no release, no tag, no container package.

📌 New pins

Head SHA: e47f3c2. No pins added or changed: no uses:, actions.lock, lockfile or digest is touched.

Changes

• .github/actions/semantic-audit-check/action.yml: unconditional "Passed" replaced with an explicit not-implemented error and exit 1.

RSR Quality Checklist

Required

• Tests pass (just test or equivalent): not run; no code or test input changed.
• Code is formatted: KYAML content, matching D280.
• Linter is clean: the action parses with yq. actionlint does not lint composite action.yml.
• No banned language patterns
• No unsafe blocks without // SAFETY: comments (n/a, no Rust)
• No banned functions
• SPDX license headers present on all new/modified source files: not ticked. The file had none before; adding one is a licence edit left to the owner.
• No secrets, credentials, or .env files included

As Applicable

• descriptiles STATE/ECOSYSTEM/META: n/a, no project state, integration or architecture change.
• Documentation updated: n/a; the action's own description is updated.
• TOPOLOGY.md: n/a
• CHANGELOG: n/a, CI placeholder only.
• New dependencies: none.
• ABI/FFI: n/a

Testing

• yq -o=json . .github/actions/semantic-audit-check/action.yml parses (KYAML content, D280; filename kept because Actions requires action.yml).
• git diff --stat origin/main: exactly 1 file changed.
• Caller check: git grep -l semantic-audit-check origin/main -- .github lists no workflow.
• Commit e47f3c2 is signed (%G? = G).

Screenshots

n/a

🤖 Generated with Claude Code

https://claude.ai/code/session_015bTuGfwCcvjrmNFejydTML

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 768a15c0-ad0f-4c8f-999e-ca7802f4750e

📥 Commits

Reviewing files that changed from the base of the PR and between 901b480 and e47f3c2.

📒 Files selected for processing (1)

• .github/actions/semantic-audit-check/action.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (21)

• GitHub Check: Dogfooding compliance summary
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: panic-attack assail
• GitHub Check: Hypatia neurosymbolic scan
• GitHub Check: Validate K9 contracts
• GitHub Check: Runtime Policy
• GitHub Check: Forth Block Tests
• GitHub Check: Build & Test core-zig
• GitHub Check: semgrep-cloud-platform/scan

⚠️ CI failures not shown inline (6)

GitHub Actions: Secret Scanner / 0_scan _ shell-secrets.txt: fix(ci): semantic-audit-check fails closed instead of printing a pass

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

---

GitHub Actions: Secret Scanner / scan _ shell-secrets: fix(ci): semantic-audit-check fails closed instead of printing a pass

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

---

GitHub Actions: Secret Scanner / 1_scan _ rust-secrets.txt: fix(ci): semantic-audit-check fails closed instead of printing a pass

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

---

GitHub Actions: Secret Scanner / scan _ rust-secrets: fix(ci): semantic-audit-check fails closed instead of printing a pass

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

---

GitHub Actions: Secret Scanner / 2_scan _ gitleaks.txt: fix(ci): semantic-audit-check fails closed instead of printing a pass

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mMIRROR="$RUNNER_TEMP/adoc-mirror"�[0m
 �[36;1mREPORT="$RUNNER_TEMP/adoc-report.json"�[0m
 �[36;1mrm -rf "$MIRROR"; mkdir -p "$MIRROR"�[0m
 �[36;1m�[0m
 �[36;1m# -print0/read -d '' so paths with spaces or newlines survive; the�[0m
 �[36;1m# estate has directories with spaces in them.�[0m
 �[36;1mfound=0�[0m
 �[36;1mwhile IFS= read -r -d '' f; do�[0m
 �[36;1m  dest="$MIRROR/$(dirname "$f")"�[0m
 �[36;1m  mkdir -p "$dest"�[0m
 �[36;1m  cp "$f" "$dest/$(basename "$f").txt"�[0m
 �[36;1m  found=$((found + 1))�[0m
 �[36;1mdone < <(find . -path ./.git -prune -o \�[0m
 �[36;1m              \( -name '*.adoc' -o -name '*.asciidoc' \) -type f -print0)�[0m
 �[36;1m�[0m
 �[36;1mif [ "$found" -eq 0 ]; then�[0m
 �[36;1m  echo "No AsciiDoc files present — nothing to scan."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Scanning $found AsciiDoc file(s) via mirror."�[0m
 �[36;1m�[0m
 �[36;1m# Honour the caller's own baseline when it has one, so repo-specific�[0m
 �[36;1m# allowlists still apply to docs exactly as they do to code — and�[0m
 �[36;1m# otherwise fall back to the estate baseline, so docs and code are�[0m
 �[36;1m# judged by the SAME rules. Previously this step honoured a repo�[0m
 �[36;1m# config while the code scan above honoured none, which meant an�[0m
 �[36;1m# allowlist entry could suppress a finding in a `.adoc` file and not�[0m
 �[36;1m# in the `.md` file beside it.�[0m
 �[36;1m#�[0m
 �[36;1m# Absolute paths: this scan's --source is the MIRROR directory, so a�[0m
 �[36;1m# relative config path would resolve against the mirror rather than�[0m
 �[36;1m# the repository. `[extend] path = ".gitleaks-estate.toml"` inside a�[0m
 �[36;1m# repo config resolves against the process CWD (still the repo root),�[0m
 �[36;1m# which is why the estate baseline is staged there.�[0m
 �[36;1mconfig_args=(--config "$PWD/.gitleaks-estate.toml")�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;...

---

GitHub Actions: Secret Scanner / scan _ gitleaks: fix(ci): semantic-audit-check fails closed instead of printing a pass

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mMIRROR="$RUNNER_TEMP/adoc-mirror"�[0m
 �[36;1mREPORT="$RUNNER_TEMP/adoc-report.json"�[0m
 �[36;1mrm -rf "$MIRROR"; mkdir -p "$MIRROR"�[0m
 �[36;1m�[0m
 �[36;1m# -print0/read -d '' so paths with spaces or newlines survive; the�[0m
 �[36;1m# estate has directories with spaces in them.�[0m
 �[36;1mfound=0�[0m
 �[36;1mwhile IFS= read -r -d '' f; do�[0m
 �[36;1m  dest="$MIRROR/$(dirname "$f")"�[0m
 �[36;1m  mkdir -p "$dest"�[0m
 �[36;1m  cp "$f" "$dest/$(basename "$f").txt"�[0m
 �[36;1m  found=$((found + 1))�[0m
 �[36;1mdone < <(find . -path ./.git -prune -o \�[0m
 �[36;1m              \( -name '*.adoc' -o -name '*.asciidoc' \) -type f -print0)�[0m
 �[36;1m�[0m
 �[36;1mif [ "$found" -eq 0 ]; then�[0m
 �[36;1m  echo "No AsciiDoc files present — nothing to scan."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Scanning $found AsciiDoc file(s) via mirror."�[0m
 �[36;1m�[0m
 �[36;1m# Honour the caller's own baseline when it has one, so repo-specific�[0m
 �[36;1m# allowlists still apply to docs exactly as they do to code — and�[0m
 �[36;1m# otherwise fall back to the estate baseline, so docs and code are�[0m
 �[36;1m# judged by the SAME rules. Previously this step honoured a repo�[0m
 �[36;1m# config while the code scan above honoured none, which meant an�[0m
 �[36;1m# allowlist entry could suppress a finding in a `.adoc` file and not�[0m
 �[36;1m# in the `.md` file beside it.�[0m
 �[36;1m#�[0m
 �[36;1m# Absolute paths: this scan's --source is the MIRROR directory, so a�[0m
 �[36;1m# relative config path would resolve against the mirror rather than�[0m
 �[36;1m# the repository. `[extend] path = ".gitleaks-estate.toml"` inside a�[0m
 �[36;1m# repo config resolves against the process CWD (still the repo root),�[0m
 �[36;1m# which is why the estate baseline is staged there.�[0m
 �[36;1mconfig_args=(--config "$PWD/.gitleaks-estate.toml")�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;...

🔇 Additional comments (1)

.github/actions/semantic-audit-check/action.yml (1)

1-14: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • The semantic-audit check now reports that the audit is unavailable and ends in failure, instead of displaying placeholder messages and reporting success. This makes the check’s result clearer when no audit capability is available. The change affects automated checks rather than features within the product.

Walkthrough

The semantic audit action no longer reports a successful placeholder check. It now reports that the audit is unavailable and exits with status 1.

Changes

Semantic audit gate

Layer / File(s)	Summary
Action failure behaviour .github/actions/semantic-audit-check/action.yml	The action reports that no audit subcommand or pinned artifact exists, then exits with status 1.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to e47f3

This change does not block an existing checked-in workflow. The action intentionally fails if invoked, until semantic audit is implemented.

Architecture Summary

Architecture risk: 🔵 Low · up to e47f3

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/actions/semantic-audit-check/action.yml: The action metadata and composite step were replaced: instead of printing placeholder checks and reporting “Semantic Audit Passed”, the step emits an error stating that the audit is unavailable and exits with status 1.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: the semantic audit action now fails closed instead of reporting a pass.
Description check	✅ Passed	The description covers the required sections, explains the change and its rationale, records checklist status, and reports testing. It clearly states that tests were not run.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the audit gate,
No command is ready to await.
An error marks the missing part,
Status one gives the clear report.
The rabbit hops, the checks now start.}

_{Comment @coderabbitai help to get the list of available commands.}