From 3d6d457eee8a3461fdb3c05b2cd12e6ccc8dc2c7 Mon Sep 17 00:00:00 2001
From: CTO Hermes <cto-hermes@users.noreply.github.com>
Date: Tue, 2 Jun 2026 21:45:05 +0700
Subject: [PATCH 1/2] chore(ci): bump actions & add Node 24 readiness
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- upload-artifact@v4 → @v7 (latest, Node 24 compatible)
- Add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true to ci.yml & release.yml
- Update cora-review fallback version v0.1.7 → v0.2.0

Co-Authored-By: codecoradev <noreply@github.com>
---
 .github/actions/cora-review/action.yml | 2 +-
 .github/workflows/ci.yml               | 1 +
 .github/workflows/release.yml          | 3 ++-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/actions/cora-review/action.yml b/.github/actions/cora-review/action.yml
index 22e56a54..bc17695d 100644
--- a/.github/actions/cora-review/action.yml
+++ b/.github/actions/cora-review/action.yml
@@ -53,7 +53,7 @@ runs:
           done
           if [ -z "$VERSION" ]; then
             echo "::warning::Failed to resolve latest cora-cli version from GitHub API, using fallback"
-            VERSION="v0.1.7"
+            VERSION="v0.2.0"
           fi
         else
           VERSION="$INPUT_VERSION"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2d309f5a..81c14327 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,7 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 permissions:
   contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3ec9d555..b48bd0b2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
   build-release:
@@ -78,7 +79,7 @@ jobs:
           7z a ${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }} ${{ matrix.artifact }}.exe
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}
           path: release/${{ matrix.artifact }}-${{ steps.version.outputs.VERSION }}.${{ matrix.ext }}

From 1f1e3232e9bf22167768dcae008975945a33d722 Mon Sep 17 00:00:00 2001
From: CTO Hermes <cto-hermes@users.noreply.github.com>
Date: Tue, 2 Jun 2026 21:56:03 +0700
Subject: [PATCH 2/2] fix(ci): fail cora-review job when LLM API fails

Previously || true swallowed all cora exit codes, so LLM API failures
(504, timeout, auth error) resulted in empty SARIF but job SUCCESS.

Now: capture exit code, fail job if cora exits non-zero AND SARIF is
empty (< 10 bytes = no valid results). Partial results still pass.

Co-Authored-By: codecoradev <noreply@github.com>
---
 .github/actions/cora-review/action.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/actions/cora-review/action.yml b/.github/actions/cora-review/action.yml
index bc17695d..04a86b56 100644
--- a/.github/actions/cora-review/action.yml
+++ b/.github/actions/cora-review/action.yml
@@ -116,11 +116,17 @@ runs:
           --format sarif \
           --severity "$INPUT_SEVERITY" \
           --quiet \
-          > cora-results.sarif 2>cora-stderr.log || true
-        echo "Cora review complete ($(wc -c < cora-results.sarif) bytes)"
+          > cora-results.sarif 2>cora-stderr.log; EXIT_CODE=$?
+        SARIF_BYTES=$(wc -c < cora-results.sarif)
+        echo "Cora review complete ($SARIF_BYTES bytes, exit=$EXIT_CODE)"
         if [ -s cora-stderr.log ]; then
           echo "::warning::Cora stderr: $(cat cora-stderr.log)"
         fi
+        # Fail if cora exited non-zero AND produced empty result (LLM API failure)
+        if [ "$EXIT_CODE" -ne 0 ] && [ "$SARIF_BYTES" -lt 10 ]; then
+          echo "::error::Cora review failed (exit=$EXIT_CODE, $SARIF_BYTES bytes). LLM API may be unavailable."
+          exit 1
+        fi
 
     - name: Upload SARIF to GitHub Code Scanning
       if: inputs.upload-sarif == 'true'