ci: the ruff gate reported success while printing its own errors

[EricAndrechek]

A required check has been passing vacuously. The python job's lint step was:

run: |
  cd python && uv sync … && uv run ruff check src tests && uv run ruff format --check src tests
  uv run python -c 'import chtypes; …'

bash -e does not exit when a command inside an && list fails — only the command following the final && is subject to it. So ruff check failed, ruff format never ran, the list returned non-zero, the next line ran anyway, and the step's status became that of the last command, which passes.

Measured, not reasoned

The job logs for a0a236c, f92e68e, 92c3360 and 2ff98c1 all report python = success while containing E501 Line too long lines. Eleven of them, then fifteen once ruff 0.16.7 added four F541 findings. The gate printed its own failures into its own log on every run and reported green.

Proved the mechanism both directions:

bash -e 'true && false && echo unreached
         echo last'                          -> exit 0   swallowed
bash -e 'true
         false
         echo unreached
         echo last'                          -> exit 1   fails correctly

Why the lint fixes are in the same commit

Repairing the gate alone would turn a required check red. So the fifteen findings it should have caught are fixed here:

• 4 × F541 (f-string without placeholders) — auto-fixed
• 11 × E501 — wrapped by splitting string literals at word boundaries, concatenated text unchanged
• then ruff format

ruff check and ruff format --check both exit 0; the python suite passes 168 tests.

Not mine, and I checked

None of the fifteen came from my earlier commits. The four files involved were last touched by #15, #19 and the 0.1.2 release — and the two lines citing docs/guides/fetch.md already read that path before #22, so my path sweep didn't lengthen them.

Audited for the same shape elsewhere

Every multi-line run: block across all five workflows. Two matched the pattern and are safe: release-python.yml and release-rust.yml's version-agreement steps put the && inside a $( ) substitution, and the following line compares the result and exits 1 — so an empty value still fails. No other instance.

🤖 Generated with Claude Code