fix(ci): repair the two quality gates that #88 exposed

[hyperpolymath]

Follow-up to #88. Making comprehensive-quality.yml parse turned 0 jobs into
11 — and two of those jobs then failed for real. They are genuine defects in
gates that had never once executed, not regressions from #88.

Both are still present on main today.

1. license — the glob matched a directory

head -5 LICENSE* also matches the LICENSES/ directory. head exits 1 on
a directory, and 2>/dev/null suppresses the message but not the exit code,
so the step died under bash -e immediately after printing "License file present".

Reproduced locally:

$ bash -e -c 'head -5 LICENSE* 2>/dev/null'; echo "exit=$?"
==> LICENSE <== ... ==> LICENSES <==
exit=1

Same family as the target/release/* trap: a glob silently matching a directory.

A trap inside the fix, worth recording. The obvious repair —
[ -f "$f" ] && head -5 "$f" in a loop — is also broken: as the last statement
in the loop body, a false test makes the whole step exit 1 under bash -e. I hit
exactly that and only caught it because I ran the form before pushing:

$ bash -e -c 'for f in LICENSE LICENSE.txt LICENSE.md; do [ -f "$f" ] && head -5 "$f"; done'; echo "exit=$?"
exit=1          # <- still broken
$ bash -e -c 'for f in LICENSE LICENSE.txt LICENSE.md; do if [ -f "$f" ]; then head -5 "$f"; fi; done'; echo "exit=$?"
exit=0          # <- correct

Shipped with the explicit if.

2. security — the semgrep pin did not exist

##[error]Unable to resolve action `returntocorp/semgrep-action@73f32468...`,
unable to find version `73f32468...`

The repo is alive (last push 2024-01-22), so this was an invented SHA, not
a dead action repo — the same class as the estate's ~80 invented pins.

Re-pinned to v1 = 713efdd345f3035192eaa63f56867b88e63e4e5d, taken from the
tags API and confirmed resolvable via repos/.../commits/<sha>. I did not guess.

Worth recording: an unresolvable uses: ref fails during action
resolution, before the step body runs — so the continue-on-error: true on
that step could not and did not rescue it. continue-on-error never protects
against a bad pin.

Caveat, deliberately not hidden: this action is deprecated (last push
2024-01) and the step is non-blocking, so SAST here is advisory only. Fixing the
pin makes it resolve; it does not make it a real gate. Replacing it with a
maintained scanner is a separate call and I have not made it for you.

Verification

• actionlint → 0 findings on the file.
• Both shell forms exercised locally under bash -e (outputs above).
• New semgrep SHA confirmed to resolve via the API.

Note on scope

Test on Racket current also failed on #88's branch (30m14s, a hang). That is
test.yml, untouched here, and it passes consistently on main — so it is not
caused by this change. Flagging it, not fixing it blind.

🤖 Generated with Claude Code

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved

CI workflow quality gate fixes correcting the LICENSE glob directory check and updating the deprecated semgrep action pin. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 7 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)