[posquit0]

👋 Background

When mise or Gitleaks installation fails, the secret scan never runs. The job fails, but its existing scan-result reporting steps are skipped, leaving no explanation in the job summary.

🔗 Related Issues

• Equivalent change: https://github.com/datarize-infra/github-actions/pull/30

⚙️ Description

Add Report tool setup failure with id: setup-failure. On tool-setup failure, write a “Secret Scan Not Run” job summary and an error annotation explaining that no scan result is available and pointing to the setup logs and a rerun after resolving the installation error.

The setup step remains fatal. The report runs with failure(); subsequent normal scan steps are skipped by their implicit success() condition, and the job remains failed. Post-job cleanup can still run.

🚨 To Reviewers

• Same 16-line change as datarize-infra/github-actions#30, including the step ID.
• Validation: actionlint, yamllint, workflow schema validation and git diff --check passed.
• Executed the actual report shell script with a temporary GITHUB_STEP_SUMMARY and confirmed the summary and error annotation.

[github-actions]

GitHub Actions Integration

Repository	jactionlint	check-jsonschema (workflows)	check-jsonschema (actions)
tedilabs/github-actions	✅	✅	✅

✅ All 1 passed.