CI ignores rubocop failures (Ruby Style job is continue-on-error) and rubocop is currently failing

[silug]

The Ruby Style job in .github/workflows/pr_tests.yml is configured with continue-on-error: true, so bundle exec rake rubocop failures do not fail CI — they are silently ignored.

Under the OpenVox test stack (voxpupuli-test, which pins rubocop 1.85 / rubocop-rspec 3.9), rubocop currently fails here:

spec/acceptance/suites/default/01_ignore_spec.rb:11 & :13  RSpec/LeakyLocalVariable
spec/unit/puppet/provider/iptables_default_policy/enforce_spec.rb:3 & :4  RSpec/LeakyLocalVariable
spec/unit/puppet/type/iptables_default_policy_spec.rb:5  RSpec/LeakyLocalVariable
37 files inspected, 5 offenses detected

Follow-up

• Fix the offense(s) above.
• Remove continue-on-error: true from the Ruby Style job so rubocop is actually enforced (note: pr_tests.yml is maintained by puppetsync, so the template likely needs updating too).

Filed as a follow-up during the round-2 OpenVox 9 / Ruby 4.0 migration.

[silug]

Root cause: genuinely pre-existing (fails identically under the old rubocop 1.88 / rubocop-rspec 3.10 stack) — RSpec/LeakyLocalVariable on define-time locals in three spec files. Fixed on the openvox9-ruby4-preview PR using let()/described_class; unit specs still pass.

rubocop is now clean here under both the voxpupuli-test stack (1.85.1/3.9) and the previous pins (1.88/3.10). Remaining scope for this issue: remove continue-on-error: true from the Ruby Style job (puppetsync template, tracked in simp/puppetsync#41).

[silug]

Closing as not planned: consolidated into simp/puppetsync#45.

This is not a per-module problem -- the ruby-style job with continue-on-error: true comes from the baseline .github/workflows/pr_tests.yml that puppetsync manages, and it affects 78 repos. Fixing it here would be undone by the next sync, so it is being handled as a single template change and rolled out in one pass (after simp/puppetsync#42 restores puppetsync).

The consolidated issue also records the trap this instance did not: the same workflow has a second, intentional continue-on-error: ${{matrix.puppet.experimental}} on the parallel_spec step gating the Ruby 4 / OpenVox 9 preview, which must survive the sweep.