From d5cc437d8d19728f0021f43bb5ff3a242f7851aa Mon Sep 17 00:00:00 2001
From: Bryce Lynn <160785634+bryce-lynn-nttd@users.noreply.github.com>
Date: Tue, 4 Aug 2026 13:50:24 -0700
Subject: [PATCH] fix: report the version-floor check as skipped rather than
 passed

Exiting 0 when the guard has not propagated made steps.version_floor.outcome
report success, so the commit status read "version floor success" without
anything being verified. During rollout that is most of the fleet.

Also surfaces stderr from --print-floor: resolution failing stays non-fatal,
but an unexpected failure no longer goes unlogged.

Both raised by @aarti-joshi-nttd on #94.
---
 .../workflows/reusable-terraform-check.yml    | 20 +++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/reusable-terraform-check.yml b/.github/workflows/reusable-terraform-check.yml
index 87dd05a..03db2c7 100644
--- a/.github/workflows/reusable-terraform-check.yml
+++ b/.github/workflows/reusable-terraform-check.yml
@@ -224,12 +224,21 @@ jobs:
         # nothing to cache -- the guard has not propagated to this repo yet, or
         # the constraint declares no lower bound -- leaving the real diagnostic
         # to the check step rather than failing here with something cryptic.
+        #
+        # Resolution failing is deliberately not fatal, but it should not be
+        # silent either: an unexpected failure here would otherwise leave no
+        # trace, and the check step reports its own error rather than this one.
         shell: bash
         run: |
           guard=".github/scripts/check-terraform-version-floor.sh"
           version=""
           if [[ -f "${guard}" ]]; then
-            version="$(bash "${guard}" --print-floor 2>/dev/null || true)"
+            if ! version="$(bash "${guard}" --print-floor 2>"${RUNNER_TEMP}/floor-resolve.err")"; then
+              version=""
+              if [[ -s "${RUNNER_TEMP}/floor-resolve.err" ]]; then
+                echo "::notice title=Version floor not resolved::$(head -3 "${RUNNER_TEMP}/floor-resolve.err")"
+              fi
+            fi
           fi
           echo "version=${version}" >> "$GITHUB_OUTPUT"
 
@@ -252,14 +261,21 @@ jobs:
         # admits. The guard ships via launch-terraform-skeleton, so it is absent
         # until a repo has picked up that update; skip loudly rather than fail,
         # and rather than pass silently.
+        #
+        # `result` exists because exiting 0 on a skip makes `outcome` report
+        # success, which would advertise a verified floor in the commit status
+        # when nothing ran. It is written after the check so a real failure
+        # leaves it unset and the status falls back to `outcome`.
         shell: bash
         run: |
           guard=".github/scripts/check-terraform-version-floor.sh"
           if [[ ! -f "${guard}" ]]; then
             echo "::notice title=Version floor check skipped::${guard} is not present in this repository yet. It arrives with the next launch-terraform-skeleton update."
+            echo "result=skipped" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           make tfmodule/check-version-floor
+          echo "result=success" >> "$GITHUB_OUTPUT"
 
       - id: update-lint-status
         name: "Update Terraform Lint status"
@@ -273,7 +289,7 @@ jobs:
             != 'failure') && 'success' || (steps.lint.outcome == 'failure' || steps.version_floor.outcome
             == 'failure') && 'failure' || 'error' }}
           description: "Terraform lint ${{ steps.lint.outcome }}, version floor ${{
-            steps.version_floor.outcome }}"
+            steps.version_floor.outputs.result || steps.version_floor.outcome }}"
           target_url: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{
             github.run_id }}"