ci: make gocyclo gating and document why Snyk is not

[cristim]

Closes #2097. This is item 10, the last open item: items 1-8, 11 and 12 merged earlier, and item 9 merged in #2278. The change follows the owner's decision.

gocyclo is now gating. I ran the exact CI command, gocyclo -over 10 -ignore "_test\.go" . (v0.6.0, the same threshold as the pre-commit hook), at origin/main without || true. It exits 0 with no offenders.

• The step now records the exit code and fails when the exit code is non-zero or when there is any output.
• gocyclo exits 0 on a nonexistent path and only prints an error, so the output check catches that case. A missing binary exits 127, which also fails.

Snyk stays non-gating (continue-on-error: true). A comment in ci.yml now explains why: it depends on an external service.

actionlint .github/workflows/ci.yml is clean.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 24 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 88 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: fb0c0deb-d063-410d-9608-2ac759245ab1

📥 Commits

Reviewing files that changed from the base of the PR and between 9caa37e and 2ab86c5.

📒 Files selected for processing: 1

• .github/workflows/ci.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Review D (independent, claude-cc-libs-rev-D): APPROVE at 2ab86c5

• ci.yml only (+9/-3). The command, threshold (-over 10) and test exclusion are unchanged; only || true is removed.
• It matches the pre-commit hook (the hook's vendor/ skip is moot, since there is no vendor/).
• It fails on a non-zero exit or any output, which covers gocyclo exiting 0 on a bad path.
• actionlint is clean.
• Snyk stays continue-on-error, with an accurate comment.
• CI was still pending at review time; the merge gate re-checks it.

[cristim]

Review C (independent, claude-cc-libs-rev-C): APPROVE at 2ab86c5

I ran the new step under bash -e -o pipefail at 2ab86c5:

• clean run: exits 0;
• nonexistent path: exits 1 (gocyclo exits 0 but prints, and the output check catches it);
• a function with complexity 12: exits 1 and names it;
• gocyclo missing from PATH: exits 1.

X=$(cmd) || RC=$? is safe under -e. "Closes" is right: the other items merged in #2234, #2218 and #2278, and item 11 was already fixed.

[cristim]

Merge gate verdict (claude-cc-libs)

Every gate holds at head 2ab86c5:

• Two independent reviews approve the reviewed head 2ab86c5. The branch was then updated from main, and the PR diff is byte-identical to the reviewed diff (compared mechanically).
• CI is green on 2ab86c5, which is the reviewed change on top of current main.
• 0 unresolved threads; MERGEABLE/CLEAN.

CodeRabbit is waived as a merge gate under the 2026-10-19 decision. Squash-merging.