From 6dcbd2988702386d431f0181a3e17b2c611f74fa Mon Sep 17 00:00:00 2001 From: Felix Geelhaar Date: Sun, 26 Jul 2026 01:12:04 +0200 Subject: [PATCH] fix(ci): remove duplicate continue-on-error that made js-ci.yml unloadable #49 added `continue-on-error: true` to js-ci's SARIF upload step, which already had one. GitHub rejects the whole file: klarlabs-studio/.github/.github/workflows/js-ci.yml@main : (Line: 176, Col: 9): 'continue-on-error' is already defined Every repo calling js-ci.yml has been failing at workflow load since #49 merged -- no jobs start, no logs are produced, and the run reports a bare "failure" with nothing to inspect. Surfaced on pet-medical-www#24. js-ci already carried this fix, with a comment saying the same thing; only go-ci was missing it. #49 should have touched go-ci alone. The guard that let this through was mine and too narrow: it searched only the first 400 characters after the step name for an existing continue-on-error, and js-ci's is behind a longer comment block. Worse, the YAML validation could not catch it either -- PyYAML accepts duplicate mapping keys silently, last one wins. Validation now uses a loader that rejects duplicates, which is what GitHub does. Claude-Session: https://claude.ai/code/session_01LMVPJFeTCEtUk2CSNBBBdK --- .github/workflows/js-ci.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/.github/workflows/js-ci.yml b/.github/workflows/js-ci.yml index 0fb3c73..7c11c27 100644 --- a/.github/workflows/js-ci.yml +++ b/.github/workflows/js-ci.yml @@ -149,16 +149,6 @@ jobs: # Go-only taint-analysis plugin is intentionally NOT installed here. run: nox scan ${{ inputs.working-directory }} -format json,sarif -output nox-results || true - name: Upload SARIF to code scanning - # Best-effort. Code scanning ingest needs GitHub Advanced Security on - # private repos; without it the upload returns "Resource not accessible - # by integration" and would fail the whole Security job. Most of the - # fleet is private, and the gate below -- not this upload -- is the - # enforcement. Same rationale as the taint-plugin install above. - # - # This only became reachable once the filename was corrected from - # findings.sarif to results.sarif: the step had silently skipped since - # it was added, so the permission problem had never surfaced. - continue-on-error: true # `-output nox-results` writes results.sarif and findings.json. The SARIF # was looked up as findings.sarif, so hashFiles() never matched and this # step has silently skipped on every run since it was added — code