Pre-existing defect identified during PR #600 QA (quality-mgr, sc-compose-600), not a regression from that PR.
Location: .github/workflows/release-preflight.yml, the done < <(python3 ...) process-substitution loop that consumes release_artifacts.py package-check-plan output.
Issue: under set -euo pipefail, a process-substitution loop's exit status is not propagated from the substituted command. If the package-check-plan generator crashes (non-zero exit, no output), the consuming while read loop simply sees zero lines and the step reports GREEN — a fail-open in release gating. This predates the manifest-aware fix in PR #600 and was confirmed still present in the new code.
Recommendation: capture the generator's exit status explicitly (e.g. write to a temp file and check $?/PIPESTATUS, or switch off process substitution) and hard-fail the step on a non-zero exit.
Flagged as a non-blocking follow-up per quality-mgr's QA report on PR #600.
Pre-existing defect identified during PR #600 QA (quality-mgr, sc-compose-600), not a regression from that PR.
Location:
.github/workflows/release-preflight.yml, thedone < <(python3 ...)process-substitution loop that consumesrelease_artifacts.py package-check-planoutput.Issue: under
set -euo pipefail, a process-substitution loop's exit status is not propagated from the substituted command. If thepackage-check-plangenerator crashes (non-zero exit, no output), the consumingwhile readloop simply sees zero lines and the step reports GREEN — a fail-open in release gating. This predates the manifest-aware fix in PR #600 and was confirmed still present in the new code.Recommendation: capture the generator's exit status explicitly (e.g. write to a temp file and check
$?/PIPESTATUS, or switch off process substitution) and hard-fail the step on a non-zero exit.Flagged as a non-blocking follow-up per quality-mgr's QA report on PR #600.