From 55c500ca7be45f80e8d3270ea553f12c1fc31c04 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Wed, 26 Aug 2026 23:56:58 +0200
Subject: [PATCH] ci: fix Gitea artifact and npm audit handling

---
 .gitea/workflows/release-gates.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/release-gates.yml b/.gitea/workflows/release-gates.yml
index 84239e59..509779e3 100644
--- a/.gitea/workflows/release-gates.yml
+++ b/.gitea/workflows/release-gates.yml
@@ -57,7 +57,7 @@ jobs:
           docker compose config > artifacts/docker-compose.resolved.yml
       - name: Publish quality evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
         with:
           name: quality-evidence
           path: |
@@ -92,11 +92,17 @@ jobs:
       - name: Audit locked frontend dependencies
         working-directory: frontend
         run: |
+          set +e
           npm ci
-          npm audit --audit-level=high --json > ../artifacts/npm-audit.json
+          install_status="$?"
+          if [ "$install_status" -ne 0 ]; then exit "$install_status"; fi
+          npm audit --audit-level=high --json | tee ../artifacts/npm-audit.json
+          audit_status="${PIPESTATUS[0]}"
+          set -e
+          exit "$audit_status"
       - name: Publish dependency evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
         with:
           name: dependency-audits
           path: |
@@ -138,7 +144,7 @@ jobs:
         run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-gis"
       - name: Publish GIS container evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
         with:
           name: container-gis-evidence
           path: |
@@ -181,7 +187,7 @@ jobs:
         run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-ai"
       - name: Publish AI container evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
         with:
           name: container-ai-evidence
           path: |