Root cause: job-level `continue-on-error: true` is silently ignored by Gitea
Actions. When sop-tier-check exits 1 (no approvals), the job fails and blocks
all PRs regardless of burn-in settings.
Fixes:
1. sop-tier-check.sh: adds jq binary download + apt-get fallback at startup,
isolated in a subshell so `set -euo pipefail` doesn't exit on failure.
2. sop-tier-check.yml "Install jq" step: `|| echo warning` ensures the step
never fails even if both curl and apt-get fail. No `set -e`.
3. sop-tier-check.yml "Verify tier label" step: SOP_FAIL_OPEN=1 env + `|| true`
on script invocation. The script always exits 0. The UI enforces the
actual merge gate. Step-level `continue-on-error: true` as belt-and-suspenders.
Combined effect: CI never fails due to missing approvals or jq issues.
Gate status is reported via workflow annotations (::notice::/::error::).
The UI merge gate enforces approvals.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
1. Workflow "Install jq" step: removed `set -e` so the step never fails
even if both curl and apt-get fail. Added `|| echo warning` as final
fallback to ensure step always exits 0.
2. Script jq fallback: moved install inside a subshell `( ... ) || { ... }`
so `set -euo pipefail` doesn't exit the script if the fallback fails.
Added explicit jq availability check after fallback with clear error.
Combined fix: workflow step never fails → script always runs → script
always has jq (or fails with clear error). The "Failing after 15s" pattern
is eliminated.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Root cause: Job-level `continue-on-error: true` is silently ignored by
Gitea Actions (only step-level is supported). When the jq binary download
fails on runners with restricted network access, the job reports "failure"
and blocks all PR merges.
Fixes:
1. Workflow: add `continue-on-error: true` to the "Install jq" step.
This prevents the step's `set -e` from failing the job when curl
can't reach GitHub releases.
2. Script: add jq binary download + apt-get fallback at script startup.
Second line of defense — runs before script uses jq. Idempotent.
Combined effect: if the workflow-level install fails, the script self-
installs before using jq. Neither failure mode blocks PR merges.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
