Problem: the smoke step asserts rc -eq 2 for flagged payloads; the binary's exit-code contract (2 = blocked) is duplicated in YAML and never asserted by the test suite. A future classifier exit-code change would break the release at the tag, silently, on every run.
Suggested fix (advisory, defer): move the expected-exit-code contract into a repo test (the binary's own black-box tests currently cover only 0 and propagation), so the YAML gate only checks against the already-tested constant.
Evidence: .github/workflows/release.yml smoke step: test \"$rc\" -eq 2 || { echo \"flagged payload exit $rc, expected 2\" >&2; exit 1; }.
Source: branch comment-checker-npm @ 23dedfd5abbbdfd35c8e883252b4055235b55654 (PR link backfilled after ship).
Metadata: Severity: P3 / Confidence: 50 / Reviewer(s): adversarial / Finding ID: release.yml-smoke-exit-code-contract
Problem: the smoke step asserts
rc -eq 2for flagged payloads; the binary's exit-code contract (2 = blocked) is duplicated in YAML and never asserted by the test suite. A future classifier exit-code change would break the release at the tag, silently, on every run.Suggested fix (advisory, defer): move the expected-exit-code contract into a repo test (the binary's own black-box tests currently cover only 0 and propagation), so the YAML gate only checks against the already-tested constant.
Evidence:
.github/workflows/release.ymlsmoke step:test \"$rc\" -eq 2 || { echo \"flagged payload exit $rc, expected 2\" >&2; exit 1; }.Source: branch
comment-checker-npm@23dedfd5abbbdfd35c8e883252b4055235b55654(PR link backfilled after ship).Metadata: Severity: P3 / Confidence: 50 / Reviewer(s): adversarial / Finding ID: release.yml-smoke-exit-code-contract