mandrel-platform 1.13.0 → 1.13.2

package/scripts/select-semgrep-python.test.mjs

@@ -20,7 +20,7 @@
  */
 
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { mkdtempSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
@@ -38,31 +38,42 @@ const FLOOR = "3.10";
  * an interpreter name to the `major.minor` it should report; a stub ignores
  * its arguments and echoes `"<major> <minor>"`, which is the only thing the
  * script asks of it.
+ *
+ * `os`, when given, additionally plants a `uname` stub that reports it. The
+ * fixture PATH is the process's WHOLE PATH, so a stub `uname` is the only
+ * `uname` the script can resolve — which is what makes the Linux-only
+ * ABI-first branch assertable from a macOS laptop and a Linux runner alike.
+ * Omit it to model a runner where the OS cannot be read at all; the script
+ * must still choose an interpreter rather than dying in a command
+ * substitution.
  */
-function stubPath(versions) {
+function stubPath(versions, { os = null } = {}) {
   const dir = mkdtempSync(join(tmpdir(), "semgrep-python-stubs-"));
   for (const [name, version] of Object.entries(versions)) {
     const [major, minor] = version.split(".");
     writeFileSync(join(dir, name), `#!/bin/sh\necho "${major} ${minor}"\n`, { mode: 0o755 });
   }
+  if (os !== null) {
+    // `uname -s` and `uname -m` are both answered; the selector only asks for
+    // `-s`, and a stub that ignores its flags cannot drift from that.
+    writeFileSync(join(dir, "uname"), `#!/bin/sh\necho "${os}"\n`, { mode: 0o755 });
+  }
   return dir;
 }
 
 /**
- * Execute the selector with the given PATH and env. Returns the exit status
- * and stdout — the script writes its `::error::` annotation to stdout, which
- * is where GitHub reads workflow commands from.
+ * Execute the selector with the given PATH and env. Returns the exit status,
+ * stdout and stderr — the script writes its `::error::` annotation to stdout,
+ * which is where GitHub reads workflow commands from, and mirrors the reason
+ * (without the prefix) to stderr for callers that capture only that stream.
  */
-function select({ path, floor = FLOOR, pin = PIN }) {
+function select({ path, floor = FLOOR, pin = PIN, lockfileAbi = null }) {
   const env = { PATH: path };
   if (floor !== null) env.SEMGREP_PYTHON_FLOOR = floor;
   if (pin !== null) env.SEMGREP_PIN = pin;
-  try {
-    const stdout = execFileSync("/bin/bash", [SCRIPT], { encoding: "utf8", env });
-    return { status: 0, stdout };
-  } catch (err) {
-    return { status: err.status, stdout: err.stdout ?? "" };
-  }
+  if (lockfileAbi !== null) env.SEMGREP_LOCKFILE_ABI = lockfileAbi;
+  const r = spawnSync("/bin/bash", [SCRIPT], { encoding: "utf8", env });
+  return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 
 /** Parse the `KEY=value` lines the script emits when it succeeds. */
@@ -215,3 +226,119 @@ test("a malformed floor fails closed", () => {
   const r = select({ path: stubPath({ python3: "3.12" }), floor: "latest" });
   assert.equal(r.status, 1, "a malformed floor must not be treated as satisfied");
 });
+
+test("a malformed floor is named as malformed, not as bash's integer error", () => {
+  // `3.1O` is the letter O, and it is the exact shape a shape-only check
+  // misses: `[0-9]*.[0-9]*` pins the first character of each field, so the
+  // typo reached `[ ... -ge "1O" ]` and produced bash's own
+  // "integer expression expected" on stderr — a message that names the shell,
+  // never the input, and leaves the step to blame the runner's interpreters
+  // for a typo in its own configuration.
+  const r = select({ path: stubPath({ python3: "3.12" }), floor: "3.1O" });
+  assert.equal(r.status, 1, "a malformed floor must not be treated as satisfied");
+  assert.match(r.stderr, /malformed/, `the reason must reach stderr: ${r.stderr}`);
+  assert.ok(
+    r.stderr.includes("3.1O"),
+    `stderr must quote the offending value back: ${r.stderr}`,
+  );
+  const combined = `${r.stdout}${r.stderr}`;
+  assert.ok(
+    !combined.includes("integer expression expected"),
+    `the input must be rejected before it reaches an arithmetic test: ${combined}`,
+  );
+});
+
+test("a floor with no minor field is malformed rather than half-read", () => {
+  // `310` splits to major "310" and a minor equal to the whole string, which
+  // an unvalidated read would silently treat as 310.310.
+  const r = select({ path: stubPath({ python3: "3.12" }), floor: "310" });
+  assert.equal(r.status, 1);
+  assert.match(r.stderr, /malformed/);
+});
+
+// ---------------------------------------------------------------------------
+// 6. Lockfile-ABI-first probe order on Linux (Story #495)
+// ---------------------------------------------------------------------------
+
+test("on Linux the lockfile's ABI interpreter is probed before bare python3", () => {
+  // The failure this closes: the hash-pinned install is valid only on a cp312
+  // interpreter, so the day a CI image rolls bare `python3` to 3.13 the old
+  // order routed the WHOLE fleet onto the un-hash-pinned fallback while an
+  // eligible python3.12 sat unused on the same PATH.
+  const r = select({
+    path: stubPath({ python3: "3.13", "python3.12": "3.12" }, { os: "Linux" }),
+    lockfileAbi: "3.12",
+  });
+  assert.equal(r.status, 0);
+  const out = parse(r.stdout);
+  assert.equal(out.SEMGREP_PYTHON, "python3.12", "the lockfile ABI must win the probe order");
+  assert.equal(out.SEMGREP_PYTHON_VERSION, "3.12");
+});
+
+test("on Darwin the same fixture still selects bare python3", () => {
+  // The mirror case, and the reason the OS is read rather than assumed: no
+  // darwin hashes are generated, so there is no ABI worth steering toward and
+  // the historical order must stand untouched.
+  const r = select({
+    path: stubPath({ python3: "3.13", "python3.12": "3.12" }, { os: "Darwin" }),
+    lockfileAbi: "3.12",
+  });
+  assert.equal(r.status, 0);
+  assert.equal(parse(r.stdout).SEMGREP_PYTHON, "python3");
+});
+
+test("with no lockfile ABI declared, Linux keeps the historical order", () => {
+  const r = select({
+    path: stubPath({ python3: "3.13", "python3.12": "3.12" }, { os: "Linux" }),
+  });
+  assert.equal(r.status, 0);
+  assert.equal(parse(r.stdout).SEMGREP_PYTHON, "python3");
+});
+
+test("a malformed lockfile ABI is ignored, not fatal", () => {
+  // The ABI only reorders probing; the floor is the check that fails closed.
+  // Turning a bad optimisation hint into a hard stop would take the security
+  // tier down for every consumer over a cosmetic input.
+  const r = select({
+    path: stubPath({ python3: "3.13", "python3.12": "3.12" }, { os: "Linux" }),
+    lockfileAbi: "cp312",
+  });
+  assert.equal(r.status, 0);
+  assert.equal(parse(r.stdout).SEMGREP_PYTHON, "python3");
+});
+
+test("the ABI candidate still has to clear the floor", () => {
+  // Probing it first is an ordering preference, not an exemption: a
+  // below-floor python3.12 must fall through exactly as any other candidate
+  // does, because the install would fail on it either way.
+  const r = select({
+    path: stubPath({ python3: "3.13", "python3.12": "3.9" }, { os: "Linux" }),
+    lockfileAbi: "3.12",
+  });
+  assert.equal(r.status, 0);
+  assert.equal(parse(r.stdout).SEMGREP_PYTHON, "python3");
+});
+
+test("an absent uname does not break selection", () => {
+  // The selector runs under the caller's `set -e`, where an unguarded command
+  // substitution on a missing binary would abort the step before any
+  // interpreter was chosen.
+  const r = select({ path: stubPath({ python3: "3.12" }), lockfileAbi: "3.12" });
+  assert.equal(r.status, 0);
+  assert.equal(parse(r.stdout).SEMGREP_PYTHON, "python3");
+});
+
+test("the fail-closed message reports the order actually probed", () => {
+  // A hard-coded list in the message would go stale the moment the ABI
+  // reorders it, and the log line is the only place a consumer can see which
+  // names were tried.
+  const r = select({
+    path: stubPath({ python3: "3.9" }, { os: "Linux" }),
+    lockfileAbi: "3.12",
+  });
+  assert.equal(r.status, 1);
+  assert.ok(
+    r.stdout.includes("Probed, in order: python3.12 python3 "),
+    `the probe order must be reported as it ran: ${r.stdout}`,
+  );
+});

package/scripts/stryker-base-config.test.mjs

@@ -82,6 +82,30 @@ test("base config disables bail so every mutant runs its full covering set", ()
   );
 });
 
+/**
+ * The cap this base pins. Stryker's own default is `n-1` logical cores (`n`
+ * when `n <= 4`), so an omitted key is not a small overshoot — it is one
+ * worker per core, 17 on an 18-core host.
+ */
+const PINNED_CONCURRENCY = 1;
+
+test("concurrency is capped so an omitted key cannot fan out to one worker per core", () => {
+  const config = readConfig();
+
+  // Equality, not presence. `Object.hasOwn(config, "concurrency")` passes on
+  // `concurrency: 17` — the very value the cap exists to prevent — so a
+  // presence check would read as covered while leaving the defect fully
+  // reachable. The number is the contract; assert the number.
+  assert.equal(
+    config.concurrency,
+    PINNED_CONCURRENCY,
+    `${CONFIG_PATH} must pin "concurrency": ${PINNED_CONCURRENCY}. Stryker ` +
+      "defaults it to one worker per core less one, so a consumer scope that " +
+      "spreads this base and omits the key takes cores no caller budgeted — " +
+      "on a shared runner host that reds a neighbouring repo's required checks.",
+  );
+});
+
 test("timeouts are raised above both Stryker's defaults and the pre-change floor", async (t) => {
   const config = readConfig();
 
@@ -172,6 +196,15 @@ test("the documented spread-import mechanism delivers the bail-free settings", a
       `that bail-free runs need; got timeoutMS ${base.timeoutMS}.`,
   );
 
+  assert.equal(
+    base.concurrency,
+    PINNED_CONCURRENCY,
+    `Importing "${PACKAGE_SPECIFIER}" must carry the concurrency cap. The ` +
+      "on-disk assertion above guards this repo; this one guards what a " +
+      "consumer's stryker.config.mjs actually receives, which is the only " +
+      "place the uncapped fan-out can happen.",
+  );
+
   // The exports map must reach *this* file, or the assertions in the rest of
   // this suite are guarding a config no consumer receives.
   assert.deepEqual(
@@ -214,6 +247,7 @@ test("annotations use the `_comment` suffix Stryker's validator exempts", () =>
     "coverageAnalysis",
     "ignoreStatic",
     "cleanTempDir",
+    "concurrency",
     "disableBail",
     "timeoutMS",
     "timeoutFactor",

package/scripts/update-semgrep-rules.mjs

@@ -79,8 +79,19 @@ const REPO_ROOT = resolve(__dirname, "..");
 // generate the file is a (harmless but inconsistent) version skew.
 const DEFAULT_SEMGREP_PIN = "semgrep==1.176.1";
 
-// SHA-256 hashes for every `DEFAULT_SEMGREP_PIN` distribution published on
-// PyPI (the four platform wheels + the sdist). pip's `--require-hashes` mode
+// Minimum interpreter for the pin above — semgrep's own `requires_python`,
+// and the same value `SEMGREP_PYTHON_FLOOR` carries in pr-quality.yml's SAST
+// step. Passed to the shared selector below so this script fails with the
+// same named error a runner gets, rather than pip's "could not find a version
+// that satisfies the requirement", which reads like a registry outage.
+const DEFAULT_SEMGREP_PYTHON_FLOOR = "3.10";
+
+// SHA-256 hashes for all 8 artifacts published on PyPI for
+// `DEFAULT_SEMGREP_PIN` — the platform wheels plus the sdist. The count is
+// asserted against this map by `check-semgrep-lockfile.test.mjs`: it read
+// "the four platform wheels + the sdist" while the array below held eight,
+// which is exactly the kind of stale gloss that makes a reader trust a
+// partial hash set. pip's `--require-hashes` mode
 // verifies the downloaded `semgrep` artifact against this set before it is
 // installed, so a compromised or swapped PyPI artifact for this exact version
 // is rejected at install time — the same "pin the supply-chain input" posture
@@ -170,11 +181,72 @@ function parseArgs(argv) {
   return opts;
 }
 
+/**
+ * Return the interpreter name to build the vendoring venv from, by RUNNING
+ * `scripts/select-semgrep-python.sh` — the same selector `pr-quality.yml`'s
+ * SAST step sources. Executed rather than sourced: run directly, the script
+ * prints `SEMGREP_PYTHON=<name>` / `SEMGREP_PYTHON_VERSION=<x.y>` and exits
+ * with the selection's own status, which is the whole interface a non-shell
+ * caller needs.
+ *
+ * A hard-coded `python3` was the alternative, and it is wrong for the reason
+ * the selector exists: macOS ships `/usr/bin/python3` = 3.9.6, below the pin's
+ * `requires_python`, so this script would install nothing and report pip's
+ * resolver error rather than naming the interpreter. Sharing the selector also
+ * means the two callers cannot drift on what "acceptable" means.
+ *
+ * @param {object} [options]
+ * @param {NodeJS.ProcessEnv} [options.env] environment the selector runs
+ *   under. Defaults to this process's. Injectable so the unit suite can hand
+ *   it a fixture PATH of stub interpreters instead of asserting against
+ *   whatever Python the host running the tests happens to ship.
+ * @returns {string} an interpreter resolvable on PATH
+ */
+export function selectPythonInterpreter({ env = process.env } = {}) {
+  const selector = join(REPO_ROOT, "scripts", "select-semgrep-python.sh");
+  // `/bin/bash` absolutely, never a bare `bash`: the PATH this resolves
+  // against is the CALLER'S `env`, so a bare name would make the interpreter
+  // itself a function of the very variable under test — and a caller passing a
+  // narrowed PATH would get a different bash, or none.
+  const result = spawnSync("/bin/bash", [selector], {
+    encoding: "utf8",
+    env: {
+      ...env,
+      SEMGREP_PIN: DEFAULT_SEMGREP_PIN,
+      SEMGREP_PYTHON_FLOOR: DEFAULT_SEMGREP_PYTHON_FLOOR,
+    },
+  });
+
+  // The selector's own `::error::` explains the failure far better than a
+  // wrapper could — it names the floor, the pin, the version found and the
+  // remedy — so it is surfaced verbatim rather than summarized away.
+  if (result.status !== 0) {
+    process.stderr.write(result.stdout ?? "");
+    process.stderr.write(result.stderr ?? "");
+    throw new Error(
+      `no interpreter on PATH satisfies Python >= ${DEFAULT_SEMGREP_PYTHON_FLOOR} for ${DEFAULT_SEMGREP_PIN}`
+    );
+  }
+
+  const line = (result.stdout ?? "")
+    .split("\n")
+    .find((l) => l.startsWith("SEMGREP_PYTHON="));
+  const selected = line ? line.slice("SEMGREP_PYTHON=".length).trim() : "";
+  if (selected === "") {
+    throw new Error(
+      `${selector} exited 0 without reporting SEMGREP_PYTHON — its run-not-source output contract changed`
+    );
+  }
+  return selected;
+}
+
 /**
  * Resolve `p/default` against a pinned, ephemeral Semgrep install and return
  * the full rule list as parsed JSON objects. Mirrors the hermetic-venv
  * install strategy `pr-quality.yml`'s SAST step uses (Story #92): an
- * ephemeral `python3 -m venv` under `mktemp -d`, never the shared user site.
+ * ephemeral venv under `mktemp -d`, never the shared user site — built from
+ * the interpreter `scripts/select-semgrep-python.sh` picks, so this script and
+ * the SAST step cannot disagree about which Python is acceptable.
  */
 function resolveRegistryRules(semgrepPin) {
   const venvDir = join(mkdtempSync(join(tmpdir(), "semgrep-vendor-")), "venv");
@@ -183,7 +255,7 @@ function resolveRegistryRules(semgrepPin) {
   const reqsFile = join(mkdtempSync(join(tmpdir(), "semgrep-vendor-reqs-")), "semgrep.txt");
 
   try {
-    spawnSync("python3", ["-m", "venv", venvDir], { stdio: "inherit" });
+    spawnSync(selectPythonInterpreter(), ["-m", "venv", venvDir], { stdio: "inherit" });
     const pip = join(venvDir, "bin", "pip");
     const semgrep = join(venvDir, "bin", "semgrep");
 
@@ -234,9 +306,15 @@ function resolveRegistryRules(semgrepPin) {
       );
     }
 
+    // Dependencies only — semgrep itself is already installed, hash-verified,
+    // above. Nothing is added to this list: the package that used to sit here
+    // was needed solely because semgrep 1.97.0's transitive
+    // `opentelemetry-instrumentation==0.46b0` imported `pkg_resources` at
+    // load, which 0.58b0 no longer does. Re-adding it would drag its own
+    // advisories back into a venv this script then runs.
     const install = spawnSync(
       pip,
-      ["install", "--quiet", "--disable-pip-version-check", "setuptools", semgrepPin],
+      ["install", "--quiet", "--disable-pip-version-check", semgrepPin],
       { stdio: "inherit" }
     );
     if (install.status !== 0) {

package/scripts/update-semgrep-rules.test.mjs

@@ -17,7 +17,11 @@
 import assert from "node:assert/strict";
 import { test } from "node:test";
 
-import { buildVendoredRuleset } from "./update-semgrep-rules.mjs";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { buildVendoredRuleset, selectPythonInterpreter } from "./update-semgrep-rules.mjs";
 
 function rule(id, languages) {
   return { id, languages, message: "m", severity: "ERROR", metadata: {} };
@@ -148,3 +152,53 @@ test("the committed .semgrep/rules.json vendored file is well-formed and non-emp
     "pnpm trustPolicy rule must remain in force (Story #132 AC)"
   );
 });
+
+// ---------------------------------------------------------------------------
+// The vendoring venv is built from the shared interpreter selector (#495)
+// ---------------------------------------------------------------------------
+
+/**
+ * Build a stub interpreter directory to be used as the WHOLE PATH.
+ *
+ * The fixture must be the whole PATH, not a prefix of it: appending a real
+ * directory leaks that host's interpreters into the probe, and the selector
+ * tries every versioned candidate rather than `python3` alone. On a
+ * merged-usr Linux runner `/bin/python3.12` is real and clears the floor, so
+ * a `${dir}:/bin` PATH quietly passed on macOS and failed in CI — the exact
+ * host-dependence this Story exists to remove from the SAST step.
+ *
+ * A `uname` stub ships with the interpreters because it is the selector's one
+ * external command, and a stub-only PATH could not otherwise resolve it. This
+ * mirrors `select-semgrep-python.test.mjs`'s own fixture builder.
+ */
+function pythonStubDir(versions, { os = "Linux" } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), "updater-python-stubs-"));
+  for (const [name, version] of Object.entries(versions)) {
+    const [major, minor] = version.split(".");
+    writeFileSync(join(dir, name), `#!/bin/sh\necho "${major} ${minor}"\n`, { mode: 0o755 });
+  }
+  writeFileSync(join(dir, "uname"), `#!/bin/sh\necho "${os}"\n`, { mode: 0o755 });
+  return dir;
+}
+
+test("selectPythonInterpreter returns the selector's choice, not a hard-coded python3", () => {
+  // A fixture PATH rather than the host's real interpreters: the branch that
+  // matters is a below-floor `python3` with a versioned sibling, which no CI
+  // tier here provides and a developer laptop provides only by accident.
+  const dir = pythonStubDir({ python3: "3.9", "python3.12": "3.12" });
+
+  assert.equal(selectPythonInterpreter({ env: { PATH: dir } }), "python3.12");
+});
+
+test("selectPythonInterpreter fails closed when nothing clears the floor", () => {
+  // Hard-coding `python3` here installed nothing on macOS system Python and
+  // reported pip's resolver error, which names neither the interpreter nor
+  // the floor. Sharing the selector means this script fails the same way the
+  // SAST step does.
+  const dir = pythonStubDir({ python3: "3.9" });
+
+  assert.throws(
+    () => selectPythonInterpreter({ env: { PATH: dir } }),
+    /satisfies Python >= 3\.10/,
+  );
+});

package/scripts/workflow-lint-gate.test.mjs

@@ -11,6 +11,15 @@
 // The other invariant these tests hold: a missing or malformed report is a
 // TOOL FAILURE and exits non-zero even in advisory mode. A gate that reports
 // "no findings" because the linter never ran is worse than no gate at all.
+//
+// Story #496 adds the third class and pins its split from the second: an
+// INFRASTRUCTURE failure — a tool that never arrived at all, because the
+// release CDN blipped, the checksum did not match, or the platform has no
+// pinned entry — obeys the same dial findings do. It used to `exit 1` inside
+// the composite's inline bash, so a CDN blip reddened every consumer's
+// required check while this tier was documented as advisory. What it must
+// never become is silent: an advisory infra failure still says, loudly, that
+// nothing was linted.
 
 import { test } from "node:test";
 import assert from "node:assert/strict";
@@ -30,9 +39,21 @@ import {
   loadReport,
   severityRank,
   resolveEnforcement,
+  classifyInfraFailure,
+  renderInfraSummary,
+  INFRA_FAILURE_ENV,
   WorkflowLintGateError,
 } from "../.github/actions/workflow-lint/workflow-lint-gate.mjs";
 
+// A composite-supplied reason, in the shape action.yml actually emits. Kept
+// free of any URL-shaped literal on purpose: asserting a substring against one
+// is CodeQL js/incomplete-url-substring-sanitization, so the marker asserted
+// on below is the slug prefix, never a host.
+const INFRA_REASON =
+  "download-failed: curl exited 22 fetching actionlint_1.7.12_linux_amd64.tar.gz " +
+  "from the actionlint release assets.";
+const INFRA_MARKER = "download-failed";
+
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const GATE = join(repoRoot, ".github/actions/workflow-lint/workflow-lint-gate.mjs");
 
@@ -423,3 +444,110 @@ test("CLI: only the literal string 'true' enables enforcement", () => {
     assert.equal(res.status, 0, `enforce=${JSON.stringify(value)} must stay advisory`);
   }
 });
+
+// ---------------------------------------------------------------------------
+// Infrastructure failure — a tool that never arrived (Story #496, AC-1)
+// ---------------------------------------------------------------------------
+
+test("classifyInfraFailure: no reason means there is nothing to report", () => {
+  assert.equal(classifyInfraFailure(undefined, false), null);
+  assert.equal(classifyInfraFailure("", true), null);
+  assert.equal(classifyInfraFailure("   \n ", true), null, "whitespace is not a reason");
+});
+
+test("classifyInfraFailure: advisory tier warns and does NOT fail", () => {
+  const infra = classifyInfraFailure(INFRA_REASON, { actionlint: false, zizmor: false });
+  assert.equal(infra.enforced, false);
+  assert.equal(infra.level, "warning");
+  assert.equal(infra.exitCode, 0, "a CDN blip must not red an advisory tier");
+  assert.ok(infra.message.includes(INFRA_MARKER), infra.message);
+});
+
+test("classifyInfraFailure: an enforcing tier fails — tier-wide or per tool", () => {
+  assert.equal(classifyInfraFailure(INFRA_REASON, true).exitCode, 1);
+  assert.equal(classifyInfraFailure(INFRA_REASON, true).level, "error");
+  // A consumer who enforced ONE tool still asked this tier to block, so a
+  // gate that could not run is a failure for them.
+  const perTool = classifyInfraFailure(INFRA_REASON, { actionlint: true, zizmor: false });
+  assert.equal(perTool.enforced, true);
+  assert.equal(perTool.exitCode, 1);
+});
+
+test("renderInfraSummary states the posture and that nothing was linted", () => {
+  const advisory = renderInfraSummary(classifyInfraFailure(INFRA_REASON, false));
+  assert.match(advisory, /advisory/);
+  assert.match(advisory, /no workflows were linted/i);
+  assert.ok(advisory.includes(INFRA_MARKER), advisory);
+  const enforcing = renderInfraSummary(classifyInfraFailure(INFRA_REASON, true));
+  assert.match(enforcing, /enforcing/);
+  assert.doesNotMatch(enforcing, /does \*\*not\*\* fail/);
+});
+
+test("CLI: an infra failure exits 0 and warns while nothing is enforced", () => {
+  const res = runGate({
+    [INFRA_FAILURE_ENV]: INFRA_REASON,
+    WORKFLOW_LINT_ENFORCE: "false",
+    WORKFLOW_LINT_ENFORCE_ACTIONLINT: "false",
+    WORKFLOW_LINT_ENFORCE_ZIZMOR: "false",
+  });
+  assert.equal(res.status, 0, res.stderr);
+  assert.match(res.stdout, /::warning::/);
+  assert.doesNotMatch(res.stdout, /::error::/);
+  assert.ok(res.stdout.includes(INFRA_MARKER), res.stdout);
+});
+
+test("CLI: the same infra failure exits 1 and errors when the tier is enforced", () => {
+  const res = runGate({
+    [INFRA_FAILURE_ENV]: INFRA_REASON,
+    WORKFLOW_LINT_ENFORCE: "true",
+  });
+  assert.equal(res.status, 1);
+  assert.match(res.stdout, /::error::/);
+  assert.ok(res.stdout.includes(INFRA_MARKER), res.stdout);
+});
+
+test("CLI: a per-tool enforce alone makes an infra failure blocking", () => {
+  const res = runGate({
+    [INFRA_FAILURE_ENV]: INFRA_REASON,
+    WORKFLOW_LINT_ENFORCE: "false",
+    WORKFLOW_LINT_ENFORCE_ZIZMOR: "true",
+  });
+  assert.equal(res.status, 1);
+  assert.match(res.stdout, /::error::/);
+});
+
+test("CLI: an advisory infra failure is never reported as a clean run", () => {
+  // The empty reports the composite writes alongside the signal carry no
+  // information. Rendering them as "no findings" would turn a gate that never
+  // ran into a green tick that looks audited.
+  const res = runGate({
+    [INFRA_FAILURE_ENV]: INFRA_REASON,
+    WORKFLOW_LINT_ENFORCE: "false",
+  });
+  assert.equal(res.status, 0, res.stderr);
+  assert.doesNotMatch(res.stdout, /no findings/);
+  assert.doesNotMatch(res.stdout, /reported no findings/);
+});
+
+test("CLI: an unset infra reason leaves the findings path untouched", () => {
+  const res = runGate({ [INFRA_FAILURE_ENV]: "" }, { zizmor: [zizmorRow()] });
+  assert.equal(res.status, 0, res.stderr);
+  assert.match(res.stdout, /excessive-permissions/);
+});
+
+test("an infra failure does not relax the missing-report rule", () => {
+  // Different class, different answer: a report that never arrived means the
+  // linter ran and produced nothing readable, which stays fatal.
+  const res = spawnSync(process.execPath, [GATE], {
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      ACTIONLINT_REPORT: "/no/such/al.json",
+      ZIZMOR_REPORT: "",
+      WORKFLOW_LINT_ENFORCE: "false",
+      [INFRA_FAILURE_ENV]: "",
+    },
+  });
+  assert.equal(res.status, 1);
+  assert.match(res.stderr, /::error::workflow-lint gate/);
+});