[IAmJSD]

Follow-up to #1398 (gosec result and binary caching), addressing the valid finding in CodeRabbit's review there.

What was wrong

scripts/run-gosec.sh exits 2 on setup failures. But an early mkdir or mktemp failure can stop it with exit 1 before gosec is installed. The gosec step treated any exit other than 2 as "binary is in its cache dir", so it set binary_ready=true, and "Save gosec binary" would then run actions/cache/save on a path that doesn't exist.

What changed

.github/workflows/ci.yml, "Run gosec Security Scanner" step:

• It now receives GOSEC_BIN_DIR from the cache-key step's bin_dir output.
• It sets binary_ready=true only when the exit code isn't 2 AND $GOSEC_BIN_DIR/gosec is an executable file.
• Findings and scan errors (exit 1 with the binary present) still save the binary, as before.

No other behavior changes. The scan, the SARIF merge, the result cache and the job verdict are untouched.

Verification

• actionlint on ci.yml: clean.
• pre-commit run --files .github/workflows/ci.yml: all hooks pass (including the workflow lint and the zizmor injection audit) except trivy-config, which can't run because trivy isn't installed locally. I ran it instead with docker run aquasec/trivy:0.69.3 config --severity HIGH,CRITICAL .github/workflows: clean, exit 0.
• scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL. The secrets scan of the changed file is clean, and the planted key was flagged.
• I can't run the cache steps outside GitHub Actions. This PR's own CI exercises the changed step.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}