Problem
The cpfusa-verify CI job reports successfully writing .fusa-evidence.json, but the very next step (upload-artifact) cannot find that file at the path it expects. The upload step only warns, so the job still shows green with no evidence artifact actually published.
Evidence
Job id 90483651135 on run 30422915741 logs:
04:47:07.4968624Z [OK] .fusa-evidence.json written
04:47:07.6834503Z ##[warning]No files were found with the provided path: .fusa-evidence.json. No artifacts will be uploaded.
The cpfusa-verify job's upload-artifact step in .github/workflows/ci.yml (name: fusa-evidence, path: .fusa-evidence.json, around line 399-402) does not set if-no-files-found, so it defaults to warn rather than error. The job's actual conclusion is success.
Why it matters
Two things are true simultaneously and both point to a real defect:
- The tool claims to write the evidence file to the current directory, but the upload step (running from a different working directory, or before the write is flushed/visible) can't find it there — a path or working-directory mismatch between the
ctest/tool invocation and the upload step.
- Because
if-no-files-found isn't set to error, this silent failure mode produces a green CI job with no artifact — exactly the kind of gap §20.1's reproducible-evidence requirement is meant to prevent.
Net effect: cpp-RCP's CI currently does not actually produce or publish .fusa-evidence.json from this job, despite the job reporting success.
Suggested fix
- Find and fix the working-directory/path mismatch so the upload step's
path: matches where the tool actually writes the file (or cd/pass an explicit --output path so they agree).
- Set
if-no-files-found: error on this upload-artifact step so a recurrence fails the job loudly instead of silently warning.
Problem
The
cpfusa-verifyCI job reports successfully writing.fusa-evidence.json, but the very next step (upload-artifact) cannot find that file at the path it expects. The upload step only warns, so the job still shows green with no evidence artifact actually published.Evidence
Job id
90483651135on run30422915741logs:The
cpfusa-verifyjob'supload-artifactstep in.github/workflows/ci.yml(name: fusa-evidence,path: .fusa-evidence.json, around line 399-402) does not setif-no-files-found, so it defaults towarnrather thanerror. The job's actual conclusion issuccess.Why it matters
Two things are true simultaneously and both point to a real defect:
ctest/tool invocation and the upload step.if-no-files-foundisn't set toerror, this silent failure mode produces a green CI job with no artifact — exactly the kind of gap §20.1's reproducible-evidence requirement is meant to prevent.Net effect: cpp-RCP's CI currently does not actually produce or publish
.fusa-evidence.jsonfrom this job, despite the job reporting success.Suggested fix
path:matches where the tool actually writes the file (orcd/pass an explicit--outputpath so they agree).if-no-files-found: erroron this upload-artifact step so a recurrence fails the job loudly instead of silently warning.