Summary

Fix the recipe-evidence comment workflow, which has failed on every run since the gate was introduced with Artifact not found for name: recipe-evidence-report.

Motivation / Context

recipe-evidence.yaml writes its report to ${{ runner.temp }}/report.md, but its upload step was gated on hashFiles(format('{0}/report.md', runner.temp)) != ''. hashFiles() only matches files inside GITHUB_WORKSPACE, and runner.temp is outside it — so the expression always returned '', the guard was always false, and the upload was always skipped. The companion recipe-evidence-comment.yaml workflow then unconditionally tried to download an artifact that never existed and hard-failed.

Confirmed against run history: the last 12 successful "Recipe Evidence: Verify" runs all show Upload evidence report → skipped, and every triggered comment run failed at the download step. Broken since #1065 (2026-05-28).

Fixes: N/A
Related: #1065

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• Other: GitHub Actions workflows (.github/workflows/recipe-evidence*.yaml)

Implementation Notes

• recipe-evidence.yaml — dropped the broken hashFiles guard. The upload step now runs on if: always() with if-no-files-found: ignore. upload-artifact reads the absolute runner.temp path without issue (only hashFiles couldn't see it), so the report now actually uploads, and a genuinely-absent report is a quiet no-op rather than an error.
• recipe-evidence-comment.yaml — added continue-on-error: true to the download step. For the legitimate case where verify fails before writing a report (no artifact), the warning-only comment gate no longer turns red; it falls through to the existing [[ ! -s report.md ]] guard that skips posting.

Testing

yamllint -c .yamllint.yaml \
  .github/workflows/recipe-evidence.yaml \
  .github/workflows/recipe-evidence-comment.yaml   # exit 0

Full end-to-end validation requires a live recipes/** PR run on GitHub: "Recipe Evidence: Verify" should show Upload evidence report → success, and "Recipe Evidence: Comment" should post the sticky comment instead of failing at download. No Go code changed, so make test/lint gates are not exercised by this change.

Risk Assessment

• Low — Isolated CI-only change, easy to revert. The affected gate is warning-only and never blocks merge.

Rollout notes: N/A — takes effect on the next recipes/** PR.

Checklist

• Tests pass locally (make test with -race) — N/A, no Go changes
• Linter passes (yamllint, exit 0)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality — N/A (CI workflow fix)
• I updated docs if user-facing behavior changed — N/A (no user-facing behavior change)
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)