[TrapsterDK]

Closes #10059

Adds .github/actions/compiler-evidence (used by the hermetic and starter-consumer jobs in place of their inline compiler evidence steps). The collect, verify, secret-scan and upload steps of hermetic, hermetic-arm64, hermetic-macos and hermetic-windows move into .github/actions/hermetic-evidence. Jobs, names and gates are unchanged; no new triggers.

Probe failures and evidence copy failures now fail the job (no || true, as in #10120). Tests run: secret_flags_test (incl. new Verify job.status condition test), action_pins_test, actionlint_test (pass). Nested-Bazel and consumer tests were not run; CI runs them. ci.yml was not dispatched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xut2hwESun1HL2eSVd1d5B

[TrapsterDK]

Added .github/actions/compiler-evidence, used by the hermetic and starter-consumer jobs. YAML parses; no nested-Bazel or consumer tests were run locally, CI must exercise them. Draft for workflow review.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xut2hwESun1HL2eSVd1d5B

[TrapsterDK]

Review: changes requested

Good: job ids and names, needs, the ci aggregate, permissions and triggers are unchanged. The artifact names (hermetic-evidence-<platform>, compiler-evidence-linux_x86_64, compiler-evidence-starter-<platform>) and the evidence file names match main. Evidence is still uploaded when tests fail: the composites are called with always(), and their scan and upload steps are always().

• Undisclosed scope: the body only mentions hermetic-evidence, but the PR also adds .github/actions/compiler-evidence/action.yml. It replaces the compiler evidence steps in hermetic (.github/workflows/ci.yml:175) and starter-consumer (:497). Update the body.
• Conflicts with ci: compiler probe tests fail normally; scan ci.yml for swallowed failures #10120: .github/actions/compiler-evidence/action.yml:54,56 keeps || true on the probe bazel build/bazel test, and .github/actions/hermetic-evidence/action.yml:22 keeps it on the cp. ci: compiler probe tests fail normally; scan ci.yml for swallowed failures #10120 removes exactly these so probe failures fail the job. Moving them into action.yml also hides them from ci: compiler probe tests fail normally; scan ci.yml for swallowed failures #10120's ci.yml-only swallows() scanner. Rebase on ci: compiler probe tests fail normally; scan ci.yml for swallowed failures #10120: keep the probe run in ci.yml or fail normally in the action, and drop the || true.
• .github/actions/hermetic-evidence/action.yml:25 (Verify): if: ${{ job.status == 'success' }} replaces the old implicit success(). It is only equivalent if job.status inside a composite reflects the outer job, i.e. verification is skipped after the qualify step fails. ci.yml has not run on this PR, so this is untested. Dispatch ci.yml and confirm Verify is skipped on a failing qualify step and runs on a passing one.
• The step order changed from verify, then collect to collect, then verify on the Linux and macOS jobs. That is harmless, since both read the same paths.
• The "analysis" check fails on an unrelated ocaml fixture error.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xut2hwESun1HL2eSVd1d5B

[TrapsterDK]

Fixed: removed || true from compiler-evidence action.yml probe build/test and hermetic-evidence cp; added test hermetic_verify_runs_only_while_the_job_is_succeeding (Verify's job.status condition plus no swallowed failures) in tools/ci/secret_flags_test.rs; PR body now mentions compiler-evidence. Rebased on main, still draft. The job.status behaviour in a real composite is still unverified until ci.yml runs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xut2hwESun1HL2eSVd1d5B

[TrapsterDK]

Review: approve

• || true is gone: .github/actions/compiler-evidence/action.yml:49,51 (probe build/test) and .github/actions/hermetic-evidence/action.yml:22 (cp). Composite bash runs with -e, so these steps now fail normally. Scan and upload are always(), so evidence is still uploaded after a failure.
• tools/ci/secret_flags_test.rs:468 adds a test for the Verify condition (job.status == 'success') and for no swallowed failures in both actions. It checks the condition text only, not runtime behavior.
• The PR body now covers compiler-evidence and ci: compiler probe tests fail normally; scan ci.yml for swallowed failures #10120.
• Job ids and names, gates, triggers (workflow_dispatch, schedule, merge_group) and contents: read permissions are unchanged. No secrets are echoed, and artifact names are the same as before.
• Remaining risk, non-blocking: job.status inside a composite is untested until ci.yml runs. Dispatch ci.yml before merging to confirm Verify is skipped after a failing qualify step.
• The one check that has reported, "analysis", has no conclusion yet.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xut2hwESun1HL2eSVd1d5B