From e3dc794a09f85a4fd1c0ec30488aa8b7519aedd5 Mon Sep 17 00:00:00 2001
From: le king fu <lekingfu@protonmail.com>
Date: Mon, 27 Jul 2026 20:00:09 -0400
Subject: [PATCH] ci: make the suppression guard log every check, not just
 failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The guard emitted nothing when it passed, so its success was indistinguishable
in the CI log from the step never running at all — the same silent-skip failure
mode it exists to catch, one level up. Confirmed on run 332: the job was green
and the log carried no trace of the step either way.

Each crate/target check and the canary now echo their result, followed by a
count and the exit code, so a reader can see the guard ran and what it proved.

Verified by extracting the run: block from the workflow and executing it
verbatim under bash -e: 4 checks, canary found, exit 0.
---
 .forgejo/workflows/check-rust.yml | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/check-rust.yml b/.forgejo/workflows/check-rust.yml
index 5579441..4617060 100644
--- a/.forgejo/workflows/check-rust.yml
+++ b/.forgejo/workflows/check-rust.yml
@@ -86,12 +86,18 @@ jobs:
       #
       # CRATES must mirror the crates named in .cargo/audit.toml. Adding an
       # entry there without adding its crate here leaves it unguarded.
+      #
+      # Every check echoes its result, including the passing ones. A guard that
+      # is silent on success cannot be told apart in the log from a guard that
+      # never ran — which is the same silent-skip failure mode this step exists
+      # to catch, one level up.
       - name: Verify suppressed advisories are still unreachable
         run: |
           set -u
           CRATES="quick-xml rsa"
           TARGETS="x86_64-unknown-linux-gnu x86_64-pc-windows-msvc"
           rc=0
+          checks=0
           for crate in $CRATES; do
             for target in $TARGETS; do
               # An absent crate exits 0 with empty stdout ("nothing to print"
@@ -104,9 +110,12 @@ jobs:
                 continue
               }
               if [ -n "$out" ]; then
-                echo "$crate is now compiled for $target — its .cargo/audit.toml suppression is no longer justified (see #310)."
+                echo "FAIL: $crate is now compiled for $target — its .cargo/audit.toml suppression is no longer justified (see #310)."
                 rc=1
+              else
+                echo "ok: $crate absent from $target"
               fi
+              checks=$((checks + 1))
             done
           done
           # Canary: a crate known to be present. If this stops being found, the
@@ -114,9 +123,12 @@ jobs:
           canary=$(cargo tree --manifest-path src-tauri/Cargo.toml --locked \
                      -i tar --target x86_64-unknown-linux-gnu 2>/dev/null) || true
           if [ -z "$canary" ]; then
-            echo "Canary failed: 'tar' was not found although it is a known dependency. The guard is not proving anything."
+            echo "FAIL: canary 'tar' was not found although it is a known dependency. The guard is not proving anything."
             rc=1
+          else
+            echo "ok: canary 'tar' found for x86_64-unknown-linux-gnu"
           fi
+          echo "Suppression guard: $checks checks, exit $rc"
           exit $rc
 
       - name: cargo test