@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-consumer-audit.mjs.ejs

@@ -0,0 +1,414 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// arbiter (generated) — consumer-resolution audit gate (#1737, Track B
+// counterpart of arbiter-self's own #1718 gate).
+//
+// CATALOG: Audits what a CONSUMER of this published npm package actually
+// CATALOG: resolves — npm pack (lifecycle scripts suppressed) -> install into
+// CATALOG: a throwaway root with no repo overrides/devDeps -> npm audit
+// CATALOG: --json at a moderate floor.
+//
+// WHY a second audit gate: the dev-tree `npm audit` step in check-all.mjs runs
+// against THIS repo's tree, where npm `overrides` (if any) are applied. npm
+// silently drops `overrides` for anyone who installs this package as a
+// dependency, so the dev-tree audit is structurally blind to that class of
+// exposure. This gate audits the CONSUMER view instead: no repo overrides, no
+// devDependencies, and a `moderate` floor — stricter than the dev-tree gate's
+// `high` floor — so a masked transitive vuln in any runtime dependency
+// resurfaces here even when the dev tree stays green.
+//
+// Exit codes (INV-53):
+//   0 — clean (consumer-resolved tree has no unsuppressed vuln >= moderate)
+//   1 — an unsuppressed vulnerability >= moderate was found in the consumer-resolved tree
+//   2 — invocation/IO error (npm pack/install/audit could not run — including a
+//       network-unreachable registry — or produced unparseable/malformed output).
+//       Fail-closed everywhere, local AND CI (INV-96): a genuinely offline
+//       developer uses the documented gate-bypass env (conscious, logged),
+//       never a silent PASS.
+//
+// Usage:
+//   node scripts/check-consumer-audit.mjs
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/** Severity floor: MODERATE and above — stricter than the dev-tree audit's `high` floor. */
+export const SEVERITY_FLOOR = new Set(['moderate', 'high', 'critical'])
+
+const GHSA_URL_RE = /\/advisories\/(GHSA-[A-Za-z0-9-]+)/
+
+/**
+ * Derive every stable suppression-scope id a vulnerability entry can be matched by:
+ * its own package name, every GHSA id / numeric advisory `source` found in a `via[]`
+ * object entry, and every upstream package name named by a `via[]` STRING entry
+ * (npm v7+ schema's representation of "transitive through another vulnerable package").
+ * @param {string} packageName
+ * @param {unknown} via
+ * @returns {Set<string>}
+ */
+function deriveScopeIds(packageName, via) {
+  const ids = new Set([packageName])
+  if (!Array.isArray(via)) return ids
+  for (const entry of via) {
+    if (typeof entry === 'string') {
+      ids.add(entry)
+      continue
+    }
+    if (entry !== null && typeof entry === 'object') {
+      const rec = /** @type {Record<string, unknown>} */ (entry)
+      if (typeof rec.url === 'string') {
+        const m = rec.url.match(GHSA_URL_RE)
+        if (m) ids.add(m[1])
+      }
+      if (typeof rec.source === 'number') ids.add(String(rec.source))
+      if (typeof rec.name === 'string') ids.add(rec.name)
+    }
+  }
+  return ids
+}
+
+/**
+ * True when a non-expired allowlist entry's `scope` matches one of the derived ids.
+ * An EXPIRED entry never suppresses — the vulnerability resurfaces (disposition
+ * allowlists are dated, not permanent, per this repo's suppression model).
+ * @param {Set<string>} ids
+ * @param {Array<Record<string, unknown>>} allowlist
+ * @param {Date} now
+ */
+function isSuppressed(ids, allowlist, now) {
+  for (const entry of allowlist) {
+    if (typeof entry?.scope !== 'string' || !ids.has(entry.scope)) continue
+    const expiry = new Date(/** @type {string} */ (entry.expiresAt))
+    if (!isNaN(expiry.getTime()) && expiry.getTime() > now.getTime()) return true
+  }
+  return false
+}
+
+/**
+ * Pure classifier over an `npm audit --json` payload (npm v7+ schema: `vulnerabilities`
+ * is an OBJECT keyed by package name, not an array) plus a disposition allowlist.
+ * Side-effect-free and unit-testable without spawning npm.
+ *
+ * @param {unknown} auditJson
+ * @param {Array<Record<string, unknown>>} allowlist
+ * @param {Date} now
+ * @returns {{ unsuppressed: Array<{ package: string, severity: string, ids: string[] }>, errored: boolean }}
+ */
+export function classifyConsumerAudit(auditJson, allowlist, now) {
+  if (auditJson === null || typeof auditJson !== 'object') {
+    return { unsuppressed: [], errored: true }
+  }
+  const obj = /** @type {Record<string, unknown>} */ (auditJson)
+  // A valid clean audit is `{ vulnerabilities: {}, metadata: {...} }` — an empty
+  // vulnerabilities object is CLEAN, not errored. Only a payload lacking BOTH keys
+  // (unrecognised schema) is treated as malformed / errored (fail-closed, never silent-pass).
+  if (!('vulnerabilities' in obj) && !('metadata' in obj)) {
+    return { unsuppressed: [], errored: true }
+  }
+  const vulnerabilities =
+    obj.vulnerabilities !== null && typeof obj.vulnerabilities === 'object'
+      ? /** @type {Record<string, unknown>} */ (obj.vulnerabilities)
+      : {}
+
+  const unsuppressed = []
+  for (const [pkgKey, raw] of Object.entries(vulnerabilities)) {
+    const entry = classifyVulnEntry(pkgKey, raw, allowlist, now)
+    if (entry) unsuppressed.push(entry)
+  }
+  return { unsuppressed, errored: false }
+}
+
+/**
+ * Classify a single `vulnerabilities` entry: the unsuppressed-finding record
+ * when the vuln meets the severity floor and no allowlist disposition covers
+ * it, or null when it is below the floor / suppressed. Extracted from
+ * classifyConsumerAudit to keep both under the 10-branch complexity ceiling.
+ * @param {string} pkgKey
+ * @param {unknown} raw
+ * @param {Array<Record<string, unknown>>} allowlist
+ * @param {Date} now
+ * @returns {{ package: string, severity: string, ids: string[] } | null}
+ */
+function classifyVulnEntry(pkgKey, raw, allowlist, now) {
+  const vuln = /** @type {Record<string, unknown>} */ (raw)
+  const severity = typeof vuln?.severity === 'string' ? vuln.severity : ''
+  if (!SEVERITY_FLOOR.has(severity)) return null
+  const name = typeof vuln?.name === 'string' ? vuln.name : pkgKey
+  const ids = deriveScopeIds(name, vuln?.via)
+  if (isSuppressed(ids, allowlist, now)) return null
+  return { package: name, severity, ids: [...ids] }
+}
+
+// ─── Impure runner (npm pack -> install -> audit) ─────────────────────────────
+
+const MAX_BUFFER = 10 * 1024 * 1024
+
+/**
+ * @param {string} repoRoot
+ * @returns {Array<Record<string, unknown>>}
+ */
+function loadAllowlist(repoRoot) {
+  const path = join(repoRoot, 'suppressions', 'consumer-audit-allowlist.json')
+  if (!existsSync(path)) return []
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8'))
+    return Array.isArray(parsed) ? parsed : []
+  } catch (err) {
+    // Malformed allowlist degrades to "no suppressions" — the SAFE direction (more
+    // vulns surface, never fewer) — but the parse failure is still surfaced, never silent.
+    process.stderr.write(
+      `check-consumer-audit: WARN — could not parse consumer-audit-allowlist.json (treating as empty): ${err?.message ?? err}\n`,
+    )
+    return []
+  }
+}
+
+/**
+ * Step 1: pack the publishable tarball WITHOUT running lifecycle scripts, so a
+ * `prepack`/`prepare` script can never mutate the working tree mid-gate.
+ * `--pack-destination` keeps the tarball out of the repo tree so the gate
+ * leaves the tree clean.
+ * @param {(args: string[], opts: object) => import('node:child_process').SpawnSyncReturns<string>} runNpm
+ * @param {string} repoRoot
+ * @param {string} packDir
+ * @returns {{ tarballPath: string } | { code: number }}
+ */
+function packTarball(runNpm, repoRoot, packDir) {
+  const pack = runNpm(['pack', '--json', '--ignore-scripts', '--pack-destination', packDir], {
+    cwd: repoRoot,
+    encoding: 'utf-8',
+    maxBuffer: MAX_BUFFER,
+  })
+  if (pack.error) {
+    process.stderr.write(
+      `check-consumer-audit: npm pack failed to invoke — ${pack.error.message}\n`,
+    )
+    return { code: 2 }
+  }
+  if (pack.status !== 0) {
+    process.stderr.write(`check-consumer-audit: npm pack failed\n${pack.stderr ?? ''}\n`)
+    return { code: 2 }
+  }
+  const filename = tarballNameFromPackOutput(pack.stdout)
+  if (filename === null) return { code: 2 }
+  return { tarballPath: join(packDir, filename) }
+}
+
+/**
+ * Parse `npm pack --json` stdout down to the packed tarball filename, or null
+ * (with the failure surfaced on stderr) when the payload is unparseable or
+ * missing the filename. Exported (and extracted from packTarball for the
+ * complexity ceiling) so both schemas below are unit-testable without spawning npm.
+ *
+ * npm < 12 emits an ARRAY: `[{ filename, ... }]`.
+ * npm >= 12 emits an OBJECT keyed by package name: `{ "<pkg>": { filename, ... } }`.
+ * Accept both — a project generated by this template must stay green for a consumer
+ * on either npm major (#1864).
+ * @param {string} stdout
+ * @returns {string | null}
+ */
+export function tarballNameFromPackOutput(stdout) {
+  let packed
+  try {
+    packed = JSON.parse(stdout)
+  } catch (err) {
+    process.stderr.write(
+      `check-consumer-audit: could not parse npm pack --json output — ${err?.message ?? err}\n`,
+    )
+    return null
+  }
+  const first = Array.isArray(packed) ? packed[0] : Object.values(packed ?? {})[0]
+  const filename = /** @type {Record<string, unknown> | undefined} */ (first)?.filename
+  if (typeof filename !== 'string' || filename.length === 0) {
+    process.stderr.write('check-consumer-audit: npm pack output missing tarball filename\n')
+    return null
+  }
+  return filename
+}
+
+/**
+ * Read the source project's `packageManager` pin (if declared), so the throwaway
+ * probe package.json below can propagate it. Under corepack, `npm install`/`npm audit`
+ * run against a package.json with NO `packageManager` field resolve npm@latest
+ * regardless of the source project's own pin — a non-deterministic drift (#1864).
+ * Exported for direct unit test coverage without spawning npm.
+ * @param {string} repoRoot
+ * @returns {string | undefined}
+ */
+export function readSourcePackageManager(repoRoot) {
+  try {
+    const pkg = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf-8'))
+    return typeof pkg?.packageManager === 'string' ? pkg.packageManager : undefined
+  } catch {
+    // Source package.json unreadable/malformed degrades to no pin (probe installs
+    // under whatever npm corepack/PATH resolves) — the pack step above reads the
+    // SAME file and will already have surfaced (and exited 2) on the identical
+    // failure, so this path is unreachable in practice.
+    return undefined
+  }
+}
+
+/**
+ * Build the throwaway probe project's package.json contents, propagating the
+ * source project's `packageManager` pin when declared (#1864). Extracted as a
+ * pure function for direct unit test coverage.
+ * @param {string | undefined} packageManager
+ * @returns {Record<string, unknown>}
+ */
+export function probePackageJson(packageManager) {
+  return {
+    name: 'consumer-probe',
+    private: true,
+    version: '0.0.0',
+    ...(typeof packageManager === 'string' && packageManager.length > 0 ? { packageManager } : {}),
+  }
+}
+
+/**
+ * Step 2: install the tarball into a throwaway root: no repo `overrides` apply
+ * (npm only honours overrides for the root project being installed), no devDeps
+ * (never installed for a dependency), and no repo .npmrc (installRoot lives
+ * under os.tmpdir(), outside the repo's cwd-walk) — the actual consumer view.
+ * @param {(args: string[], opts: object) => import('node:child_process').SpawnSyncReturns<string>} runNpm
+ * @param {string} installRoot
+ * @param {string} tarballPath
+ * @param {string | undefined} packageManager
+ * @returns {number} 0 on success, INV-53 exit code otherwise
+ */
+function installTarball(runNpm, installRoot, tarballPath, packageManager) {
+  writeFileSync(
+    join(installRoot, 'package.json'),
+    JSON.stringify(probePackageJson(packageManager), null, 2),
+  )
+  const install = runNpm(['install', tarballPath, '--no-audit', '--no-fund', '--ignore-scripts'], {
+    cwd: installRoot,
+    encoding: 'utf-8',
+    maxBuffer: MAX_BUFFER,
+  })
+  if (install.error) {
+    process.stderr.write(
+      `check-consumer-audit: npm install failed to invoke — ${install.error.message}\n`,
+    )
+    return 2
+  }
+  if (install.status !== 0) {
+    const combined = `${install.stderr ?? ''}\n${install.stdout ?? ''}`
+    process.stderr.write(`check-consumer-audit: npm install failed\n${combined}\n`)
+    return 2
+  }
+  return 0
+}
+
+/**
+ * Step 3: audit the resolved consumer tree. Never trust the exit code — `npm audit`
+ * exits non-zero whenever ANY vuln exists; this gate's own policy (moderate
+ * floor + dated disposition allowlist) decides pass/fail, not npm's default.
+ * @param {(args: string[], opts: object) => import('node:child_process').SpawnSyncReturns<string>} runNpm
+ * @param {string} installRoot
+ * @returns {{ auditJson: unknown } | { code: number }}
+ */
+function runConsumerAudit(runNpm, installRoot) {
+  const audit = runNpm(['audit', '--json'], {
+    cwd: installRoot,
+    encoding: 'utf-8',
+    maxBuffer: MAX_BUFFER,
+  })
+  if (audit.error) {
+    process.stderr.write(
+      `check-consumer-audit: npm audit failed to invoke — ${audit.error.message}\n`,
+    )
+    return { code: 2 }
+  }
+  try {
+    return { auditJson: JSON.parse(audit.stdout) }
+  } catch (err) {
+    process.stderr.write(
+      `check-consumer-audit: could not parse npm audit --json output — ${err?.message ?? err}\n`,
+    )
+    return { code: 2 }
+  }
+}
+
+/**
+ * Print the FAIL report for unsuppressed consumer-facing vulns.
+ * @param {Array<{ package: string, severity: string, ids: string[] }>} unsuppressed
+ * @returns {number} 1 (gate FAIL, INV-53)
+ */
+function reportUnsuppressed(unsuppressed) {
+  process.stderr.write(
+    `check-consumer-audit: FAIL — ${unsuppressed.length} unsuppressed consumer-facing vulnerabilit${
+      unsuppressed.length === 1 ? 'y' : 'ies'
+    } >= moderate:\n`,
+  )
+  for (const v of unsuppressed) {
+    process.stderr.write(`  ${v.package}  [${v.severity}]  ids: ${v.ids.join(', ')}\n`)
+  }
+  process.stderr.write(
+    '\nRemediate at source (bump/replace the dependency), or add a dated disposition to\n' +
+      'suppressions/consumer-audit-allowlist.json (reason + owner + expiresAt + scope)\n' +
+      'referencing a tracking issue. Never lower the moderate floor.\n',
+  )
+  return 1
+}
+
+/**
+ * Orchestrate pack -> install -> audit -> classify. Each step lives in its own
+ * helper (packTarball/installTarball/runConsumerAudit/reportUnsuppressed) to
+ * keep every function under the 10-branch complexity ceiling.
+ * @param {string} repoRoot
+ * @returns {number} exit code (INV-53)
+ */
+function main(repoRoot) {
+  const packDir = mkdtempSync(join(tmpdir(), 'consumer-audit-pack-'))
+  const installRoot = mkdtempSync(join(tmpdir(), 'consumer-audit-install-'))
+  const runNpm = (/** @type {string[]} */ args, /** @type {object} */ opts) =>
+    spawnSync('npm', args, opts)
+  try {
+    const packResult = packTarball(runNpm, repoRoot, packDir)
+    if ('code' in packResult) return packResult.code
+
+    const installCode = installTarball(
+      runNpm,
+      installRoot,
+      packResult.tarballPath,
+      readSourcePackageManager(repoRoot),
+    )
+    if (installCode !== 0) return installCode
+
+    const auditResult = runConsumerAudit(runNpm, installRoot)
+    if ('code' in auditResult) return auditResult.code
+
+    const allowlist = loadAllowlist(repoRoot)
+    const { unsuppressed, errored } = classifyConsumerAudit(
+      auditResult.auditJson,
+      allowlist,
+      new Date(),
+    )
+    if (errored) {
+      process.stderr.write(
+        'check-consumer-audit: malformed npm audit payload (neither vulnerabilities nor metadata present)\n',
+      )
+      return 2
+    }
+    if (unsuppressed.length > 0) return reportUnsuppressed(unsuppressed)
+
+    process.stdout.write(
+      'check-consumer-audit: OK (consumer-resolved tree clean at moderate floor)\n',
+    )
+    return 0
+  } finally {
+    rmSync(packDir, { recursive: true, force: true })
+    rmSync(installRoot, { recursive: true, force: true })
+  }
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  try {
+    process.exit(main(process.cwd()))
+  } catch (err) {
+    process.stderr.write(`check-consumer-audit: ${err?.message ?? err}\n`)
+    process.exit(2)
+  }
+}

package/dist/templates/scripts/check-continue-on-error.mjs.ejs

@@ -0,0 +1,227 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// scripts/check-continue-on-error.mjs — generated by arbiter (anti-fake-green A3, INV-89).
+//
+// Parser-backed swallowed-gate guard. A GATING job/step carrying a const-true `continue-on-error`
+// swallows its own failure — a red gate goes green with the regression never surfaced. The truthy
+// value is read through the YAML 1.1 boolean grammar, so the const-true forms a plain regex misses
+// are caught:
+//   continue-on-error: on        # YAML-1.1 `on`  → boolean true   (a regex for `true` MISSES this)
+//   continue-on-error: yes       # YAML-1.1 `yes` → boolean true
+//   continue-on-error: ${{ true }}   # const-true GitHub expression
+// js-yaml confirms when installed; otherwise the YAML-1.1 truthy-token set is the tolerant fallback.
+// A dynamic expression (`${{ <expr> }}`) is indeterminate ⇒ NOT flagged. The SOLE sanctioned step
+// is an artifact up/download (its failure must not block CI); informational workflows
+// (heartbeat/nightly/weekly/monthly/notify) and an audited `# arbiter-allow-continue-on-error`
+// marker are also exempt. NO-DATA (no workflows) is a PASS.
+//
+// Usage: node scripts/check-continue-on-error.mjs [--dir <path>] [--help]
+// Exit codes (INV-53): 0=PASS, 1=FAIL (swallowed gate), 2=ERROR (self).
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { join, resolve, basename } from 'node:path'
+import { createRequire } from 'node:module'
+
+const args = process.argv.slice(2)
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write(
+    [
+      'Usage: node scripts/check-continue-on-error.mjs [--dir <path>]',
+      '',
+      'Fails when a GATING job/step carries a const-true `continue-on-error` — catching the',
+      'YAML-1.1 `on`/`yes` and `${{ true }}` forms a plain regex misses. The sole sanctioned step',
+      'is an artifact up/download; informational workflows and an audited',
+      '`# arbiter-allow-continue-on-error` marker are exempt. NO-DATA (no workflows) is a PASS.',
+      '',
+    ].join('\n') + '\n',
+  )
+  process.exit(0)
+}
+
+const dirArg = args.indexOf('--dir')
+const ROOT = dirArg >= 0 && args[dirArg + 1] ? resolve(args[dirArg + 1]) : process.cwd()
+
+// js-yaml is OPTIONAL — present in some toolchains, absent in a fresh project. Loaded lazily; the
+// guard falls back to the YAML-1.1 token grammar so it never hard-depends on it.
+let yamlLib = null
+try {
+  yamlLib = createRequire(import.meta.url)('js-yaml')
+} catch {
+  yamlLib = null
+}
+
+const INFORMATIONAL_PATTERNS = ['heartbeat', 'nightly', 'weekly', 'monthly', 'notify']
+const STEP_SCOPED_ALLOWLIST = { 'drift-shadow.yml': new Set(['parity']) }
+const TRUTHY_TOKENS = new Set(['true', 'on', 'yes', 'y'])
+const GATE_COMMAND_RE =
+  /\b(?:check-all(?:\.mjs)?|scripts\/check-[\w.-]+\.mjs|arbiter\s+(?:verify|gold-audit|anti-fake-green)|npm\s+(?:run\s+)?test|npm\s+run\s+(?:lint|gate|check[\w:-]*)|npx\s+(?:vitest|jest|eslint|tsc|playwright)\b|pnpm\s+(?:run\s+)?test|yarn\s+test|vitest\b|jest\b|pytest\b|cargo\s+(?:test|clippy)\b|go\s+test\b|(?:\.\/)?gradlew\b[^\n]*\b(?:test|check|verify)\b|mvn\b[^\n]*\b(?:test|verify)\b)/
+
+function collectYamlFiles(dir) {
+  if (!existsSync(dir)) return []
+  const out = []
+  let entries
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return out
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue
+    const full = join(dir, entry.name)
+    if (entry.isDirectory()) out.push(...collectYamlFiles(full))
+    else if (entry.isFile() && (entry.name.endsWith('.yml') || entry.name.endsWith('.yaml')))
+      out.push(full)
+  }
+  return out
+}
+
+function isConstTrueValue(rawValue) {
+  let v = String(rawValue)
+    .replace(/\s+#.*$/, '')
+    .trim()
+  if (v === '') return false
+  if (/^\$\{\{\s*true\s*\}\}$/i.test(v)) return true
+  if (v.includes('${{')) return false // dynamic expression ⇒ indeterminate, not flagged
+  v = v.replace(/^["']|["']$/g, '')
+  if (TRUTHY_TOKENS.has(v.toLowerCase())) return true
+  if (yamlLib && typeof yamlLib.load === 'function') {
+    try {
+      return yamlLib.load(`v: ${v}`)?.v === true
+    } catch {
+      return false
+    }
+  }
+  return false
+}
+
+function enclosingBlock(lines, i, coeIndent) {
+  const isKey = (ln) => /^\s*['"]?[\w.-]+['"]?\s*:/.test(ln)
+  const isDash = (ln) => /^(\s*)-\s/.exec(ln)
+  const skip = (ln) => ln.trim() === '' || /^\s*#/.test(ln)
+
+  let dashIdx = -1
+  let dashIndent = -1
+  for (let j = i - 1; j >= 0; j--) {
+    const ln = lines[j]
+    if (skip(ln)) continue
+    const dash = isDash(ln)
+    const indent = ln.length - ln.trimStart().length
+    if (dash && dash[1].length < coeIndent) {
+      dashIdx = j
+      dashIndent = dash[1].length
+      break
+    }
+    if (!dash && indent < coeIndent && isKey(ln)) break
+  }
+
+  if (dashIdx >= 0) {
+    const out = [lines[dashIdx]]
+    for (let j = dashIdx + 1; j < lines.length; j++) {
+      const ln = lines[j]
+      if (ln.trim() === '') {
+        out.push(ln)
+        continue
+      }
+      const indent = ln.length - ln.trimStart().length
+      const dash = isDash(ln)
+      if (dash && dash[1].length === dashIndent) break
+      if (!dash && indent <= dashIndent && isKey(ln)) break
+      out.push(ln)
+    }
+    const text = out.join('\n')
+    const idM = /^\s*id:\s*(\S+)/m.exec(text)
+    const nameM = /^\s*-?\s*name:\s*(.+)$/m.exec(text)
+    return {
+      kind: 'step',
+      text,
+      stepId: idM ? idM[1].replace(/['"]/g, '') : null,
+      label: nameM ? nameM[1].trim() : '(unnamed step)',
+    }
+  }
+
+  let jobIdx = -1
+  let jobIndent = -1
+  for (let j = i - 1; j >= 0; j--) {
+    const ln = lines[j]
+    if (skip(ln)) continue
+    const indent = ln.length - ln.trimStart().length
+    if (indent < coeIndent && isKey(ln)) {
+      jobIdx = j
+      jobIndent = indent
+      break
+    }
+  }
+  if (jobIdx < 0)
+    return { kind: 'job', text: lines.slice(i, i + 1).join('\n'), stepId: null, label: '(job)' }
+  const km = /^(\s*)['"]?([\w.-]+)['"]?\s*:/.exec(lines[jobIdx])
+  const out = [lines[jobIdx]]
+  for (let j = jobIdx + 1; j < lines.length; j++) {
+    const ln = lines[j]
+    if (ln.trim() === '') {
+      out.push(ln)
+      continue
+    }
+    const indent = ln.length - ln.trimStart().length
+    if (indent <= jobIndent && isKey(ln)) break
+    out.push(ln)
+  }
+  return { kind: 'job', text: out.join('\n'), stepId: null, label: km ? km[2] : '(job)' }
+}
+
+function findViolations(filePath) {
+  const name = basename(filePath)
+  if (INFORMATIONAL_PATTERNS.some((p) => name.includes(p))) return []
+  let text
+  try {
+    text = readFileSync(filePath, 'utf-8')
+  } catch {
+    return []
+  }
+  const allowedSteps = STEP_SCOPED_ALLOWLIST[name]
+  const lines = text.split('\n')
+  const findings = []
+  for (let i = 0; i < lines.length; i++) {
+    const m = /^(\s*)continue-on-error:\s*(.+?)\s*$/.exec(lines[i])
+    if (!m) continue
+    if (!isConstTrueValue(m[2])) continue
+    const block = enclosingBlock(lines, i, m[1].length)
+    if (/\b(?:upload|download)-artifact\b/.test(block.text)) continue
+    // Audited opt-out must carry a non-empty reason; a bare/empty marker does NOT bypass (#1499).
+    if (/arbiter-allow-continue-on-error:[ \t]*\S/.test(block.text)) continue
+    if (allowedSteps && block.stepId && allowedSteps.has(block.stepId)) continue
+    if (!GATE_COMMAND_RE.test(block.text)) continue
+    findings.push(
+      `${filePath}:${i + 1}: continue-on-error swallows a GATING ${block.kind} ("${block.label}") — a swallowed gate is a fake-green`,
+    )
+  }
+  return findings
+}
+
+function main() {
+  const findings = []
+  for (const file of collectYamlFiles(join(ROOT, '.github', 'workflows'))) {
+    for (const v of findViolations(file)) findings.push(v)
+  }
+  if (findings.length > 0) {
+    process.stderr.write(
+      'check-continue-on-error: FAIL — a GATING job/step swallows its failure via continue-on-error:\n',
+    )
+    for (const f of findings) process.stderr.write(`    ${f}\n`)
+    process.stderr.write(
+      '  Fix: let the gate fail the run. If the step is genuinely non-blocking, make it an\n' +
+        '  artifact up/download, an informational workflow, or annotate it with an audited\n' +
+        '  `# arbiter-allow-continue-on-error: <reason>` marker.\n',
+    )
+    return 1
+  }
+  process.stdout.write(
+    'check-continue-on-error: no swallowed gates — PASS (NO-DATA when no workflows)\n',
+  )
+  return 0
+}
+
+try {
+  process.exit(main())
+} catch (e) {
+  process.stderr.write(`check-continue-on-error: ERROR — ${e?.message ?? e}\n`)
+  process.exit(2)
+}