Stop ignoring rubocop failures: remove continue-on-error from the ruby-style job (78 repos)

[silug]

Summary

The ruby-style job in the baseline .github/workflows/pr_tests.yml is declared
continue-on-error: true, so rubocop failures never fail a PR. The job runs, goes
red internally, and the check reports success. Rubocop is effectively advisory across
the whole fleet.

Surveyed 2026-07-27: 78 repos carry the unconditional form.

  ruby-style:
    name: 'Ruby Style'
    runs-on: ubuntu-latest
    continue-on-error: true        # <-- remove this

⚠️ Do not strip continue-on-error blindly

There are two distinct uses in this workflow and only one is a bug:

Occurrence	Repos	Action
ruby-style: job → continue-on-error: true	78	remove — this is the bug
parallel_spec step → continue-on-error: ${{matrix.puppet.experimental}}	75	keep — this gates the Ruby 4 / OpenVox 9 preview matrix entry

74 repos have both. A sweep matching on continue-on-error alone would take out the
OpenVox 9 preview along with the rubocop gate. Match on the literal job-level
continue-on-error: true only.

Why this should be one pass

No SIMP-maintained repo parks known violations: 0 of the 78 have a
.rubocop_todo.yml. (37 repos in the org do have one, but they are all vendored/forked
modules — augeasproviders_*, pupmod-voxpupuli-*, inspec_tools,
binford2k-node_encrypt — and none of them uses this pr_tests.yml baseline.)
Combined with the historical per-module "Clean up for rubocop" commits, the fleet is
plausibly already clean, so flipping the gate should stay green.

Absence of a todo file is not proof of zero offenses, though — it is only knowable by
running rubocop. Suggest landing the change on one pilot module and confirming the
Ruby Style job passes before the full sweep.

Blocked on

#42 — needs puppetsync working again before this can be rolled out.

Consolidates

Filed per-module on a sample of repos before this was understood as a baseline issue;
those are being closed in favor of this one:

• CI ignores rubocop failures (Ruby Style job is continue-on-error) and rubocop is currently failing pupmod-simp-haveged#84
• CI ignores rubocop failures (Ruby Style job is continue-on-error) and rubocop is currently failing pupmod-simp-site#62
• CI ignores rubocop failures (Ruby Style job is continue-on-error) and rubocop is currently failing pupmod-simp-iptables#167
• CI ignores rubocop failures (Ruby Style job is continue-on-error) and rubocop is currently failing pupmod-simp-deferred_resources#94
• CI ignores rubocop failures (Ruby Style job is continue-on-error) and rubocop is currently failing pupmod-simp-auditd#265

[silug]

Closing as not planned — duplicate of #41, which predates this by ~3 weeks and is the broader issue.

I filed this during org-wide issue triage without first checking existing puppetsync issues. That was a miss: #41 already covered the problem and covers more of it.

What #41 has that this issue lacks: the template vs deployed divergence. The baseline template at modules/profile/files/pupmod/_github/workflows/pr_tests.yml has the job disabled —

  ruby-style:
    if: false # TODO Modules will need: rubocop in Gemfile, .rubocop.yml
    name: 'Ruby Style (experimental)'
    continue-on-error: true

— while the deployed modules have drifted to a running 'Ruby Style' job that still carries continue-on-error: true. This issue only surveyed the deployed side and implicitly assumed the template matched it, so "remove continue-on-error" is an incomplete fix: the if: false and (experimental) name have to be reconciled too. #41 also already tracked the same 5 per-module issues and records (2026-07-10) that PR #42 deliberately keeps continue-on-error: true to match reality, with removal riding the following template pass.

What this issue added has been copied to #41 in a comment, so nothing is lost:

• the two-continue-on-error warning (78 job-level vs 75 matrix-gated ${{matrix.puppet.experimental}}, 74 with both) — the trap that would break the OpenVox 9 preview gate
• the refined count (78 of the 82 repos with a pr_tests.yml, all SIMP-maintained)
• the .rubocop_todo.yml evidence (0 of 78) and the pilot-first suggestion

Follow #41. The REFERENCE.md sibling issue #46 is unaffected — no existing issue covered that one.