From e4127d6fcac6d0333e38d1a911feb3773fee45a3 Mon Sep 17 00:00:00 2001
From: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
Date: Tue, 16 Jun 2026 19:58:13 -0700
Subject: [PATCH] fix: release.yml coverage gcov-12 + non-blocking
 certification gap reports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After the YAML parse fix (PR #10) the Release workflow ran for real and surfaced
two runtime failures, both already solved the same way in ci.yml:

1. `lcov --capture` failed with "GCOV failed ... .gcda" because the coverage
   build uses g++-12 but the runner's default gcov is v11. Add
   `--gcov-tool gcov-12`, matching ci.yml.

2. The certification gap/coverage reports (ISO 26262 ASIL-B, IEC 61508 SIL-2,
   DO-178C DAL-B, structural coverage, full compliance report) grade against
   100% thresholds the stub bridge implementations cannot meet, so they exit
   non-zero by design. The release workflow's job is to GENERATE these artifacts,
   not gate on them (gating lives in ci.yml), so append `|| true` — same pattern
   as ci.yml's cpfusa-report job. Pure artifact generators (fmea, safety-case,
   tara, sbom, sas, sci, audit-pack, badge) and the qualify gate stay hard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
---
 .github/workflows/release.yml | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9e7a95b..df4c014 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,6 +50,7 @@ jobs:
           ctest --test-dir build-cov --output-on-failure -j1
           lcov --capture \
             --directory build-cov \
+            --gcov-tool gcov-12 \
             --output-file coverage.info
           lcov --remove coverage.info \
             '*/tests/*' '*/catch2/*' '*/FetchContent/*' \
@@ -67,30 +68,36 @@ jobs:
       - name: Regenerate SBOM, provenance, and artifact manifest
         run: /tmp/cpfusa/build/cpfusa release
 
+      # Gap/coverage reports below grade against certification targets
+      # (ASIL-B / SIL-2 / DAL-B). Stub bridge implementations cannot reach the
+      # 100% thresholds those targets demand, so these commands exit non-zero by
+      # design — but the workflow's job is to GENERATE the report artifact, not
+      # to gate on it (gating lives in ci.yml). `|| true` keeps the artifact
+      # while letting the report record the gaps.
       - name: Regenerate ISO 26262 gap report (ASIL-B)
         run: |
           /tmp/cpfusa/build/cpfusa iso26262 \
             --asil ASIL-B \
-            --output iso26262-gap-report.json
+            --output iso26262-gap-report.json || true
 
       - name: Regenerate IEC 61508 gap report (SIL-2)
         run: |
           /tmp/cpfusa/build/cpfusa iec61508 \
             --sil SIL-2 \
-            --output iec61508-gap-report.json
+            --output iec61508-gap-report.json || true
 
       - name: Regenerate DO-178C gap report (DAL-B)
         run: |
           /tmp/cpfusa/build/cpfusa do178 \
             --dal DAL-B \
-            --output do178-gap-report.json
+            --output do178-gap-report.json || true
 
       - name: Regenerate structural coverage report (DO-178C)
         run: |
           /tmp/cpfusa/build/cpfusa coverage \
             --profile coverage.info \
             --dal DAL-B \
-            --output coverage-report.json
+            --output coverage-report.json || true
 
       - name: Regenerate Software Accomplishment Summary (DO-178C §11.20)
         run: /tmp/cpfusa/build/cpfusa sas
@@ -106,8 +113,8 @@ jobs:
 
       - name: Generate full compliance report
         run: |
-          /tmp/cpfusa/build/cpfusa report --format json --output report.json
-          /tmp/cpfusa/build/cpfusa report --format html --output report.html
+          /tmp/cpfusa/build/cpfusa report --format json --output report.json || true
+          /tmp/cpfusa/build/cpfusa report --format html --output report.html || true
 
       - name: Tool qualification evidence
         run: /tmp/cpfusa/build/cpfusa qualify