Skip to content

[cpp-RCP-13] Additional cpfusa CI/report steps masked with "|| true" beyond the already-tracked analyze step #81

Closed

Description

@SoundMatt

Location: .github/workflows/ci.yml:358 (cpfusa trace --gaps), :503 (cpfusa coverage --dal DAL-B), :506 and :509 (cpfusa report, JSON and SARIF), :512 (cpfusa metrics record); .github/workflows/release.yml:81-100 (ISO 26262 / IEC 61508 / DO-178C gap reports and the structural coverage report) and :116-117 (cpfusa report, JSON and HTML).

Finding: Beyond the clang-tidy gate (filed separately) and the cpfusa analyze step (already tracked in #60), several other cpp-FuSa-driven CI/release steps are also suffixed with || true, so none of them can fail their job: the traceability-gaps report, the DAL-B structural-coverage report generation, both compliance-report formats, and the metrics-recording step in ci.yml; and the ISO 26262/IEC 61508/DO-178C gap reports plus the JSON/HTML compliance reports in release.yml. Some of these are legitimately meant to be artifact-generation-only (the release.yml comment near those lines explains that gating is meant to live in ci.yml, not there), but several of the ci.yml instances sit in a job whose surrounding steps (like the DAL-B coverage report right before the CI gate section) read as if they're meant to enforce something, when in fact none of them can currently cause a failure.

Recommendation: For each || true-suffixed step, decide explicitly whether it's meant to gate or just to generate an artifact. For anything meant to gate, remove the || true (or replace it with logic that inspects the tool's actual pass/fail signal and exits non-zero accordingly). For anything genuinely artifact-generation-only, keep || true but make that intent clear in the step name/comments so a reader doesn't mistake a green run for a passing gate.

Verification: Independently re-read .github/workflows/ci.yml and .github/workflows/release.yml against current HEAD (commit 4b9449a, 2026-07-29). Confirmed each cited line still ends in || true. This issue is deliberately scoped to exclude the cpfusa analyze step at ci.yml:319, since that specific instance is already tracked in issue #60.

Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.

Activity

  1. added a commit that references this issue on Jul 30, 2026
  2. SoundMatt commented on Jul 30, 2026

    @SoundMatt
    OwnerAuthor

    Fixed by #92 (merged), which was not auto-linked because the PR description's bold markdown around the issue numbers broke GitHub's closing-keyword parser.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions