Review found the same defect this PR set out to fix, one layer down.

run_commit_check has always failed only on "fail", but add_job_summary,
add_pr_comments (two call sites) and set_result_output each asked
`all(scope.status == "pass")` instead. Those were equivalent only while
pass and fail were the only statuses. With skip added, a skipped-only run
rendered "⊘ All N checks skipped" and then exited 1 and emitted result
status "fail" -- a bypassed policy turned into a broken build.

Four copies of a two-state assumption is the same shape as the four copies
of the reduce-to-overall rule in commit-check#537, so it gets the same
remedy: overall_status() and exit_code_for(), defined once and used by
every path.

Three smaller findings, all real:

* _markdown_table skipped only `pass` scopes, so a run with both a failure
  and a skip added a row with no value and no rule links -- a blank
  accusation under a "Failed checks" heading. It now takes failures only.
* The all-skipped verdict fired on an empty result set, where
  `skipped == total` is trivially true, reporting "All 0 checks skipped".
  It now requires a scope, matching the guard the step log already had.
* The step log said "all checks passed (2 skipped)" for a partial skip,
  contradicting its own report headline. It now reads
  "2 of 3 checks passed, 1 skipped".

Each fix is pinned by a test that fails when the fix is reverted, checked
one at a time.

Not changed: the requirements.txt pin. The README documents 2.13.4 as the
minimum for ⊘ to appear, and 2.13.4 does not exist yet -- commit-check#537
is still open. Pinning it now would install a version that cannot be
resolved. The rendering is back-compatible by construction, so the bump
belongs with the release, not here.

The subject avoids "treat", which reads as imperative but is absent from
the 396-verb list in commit-check 2.13.1 -- the version this action still
pins. It was added by commit-check#527 and shipped in 2.13.2, so the
whitelist on the runner is three releases behind the project's own. The
pin bump in #258 fixes that; this only sidesteps it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9zFxq8V4qxG4aMzJhGBFn

PR #258 in this repository reported "All 5 checks passed" over five green
ticks while validating nothing: its author is dependabot[bot], which the
org config lists in ignore_authors, so every rule was bypassed. The report
had no way to say so -- ScopeResult knew only pass and fail, and a skip
arrived looking exactly like a pass.

The bare labels in that summary were the only hint anything was different,
and only because a skipped check reports no value. That was incidental, not
a signal.

commit-check 2.13.4 reports "status": "skip", so this consumes it:

  * ScopeResult.status gains "skip", set when every check in the scope
    skipped. One real verdict outranks the skips.
  * Skipped scopes render "⊘ <label> (skipped)" -- deliberately not a ✔,
    and with no value, because nothing was examined.
  * The headline distinguishes the three cases. All skipped reads
    "⊘ All N checks skipped — nothing was validated"; a partial skip reads
    "✅ 3 of 5 checks passed, 2 skipped" rather than claiming all passed.
  * The step log line follows the same rule.

Back-compatible by construction: against an engine that never emits "skip"
no branch here is reachable, and a test pins that the old rendering is
unchanged.

Adds a golden test for the fully skipped report so the layout stays exact,
alongside tests for the partial-skip headline, failure precedence, and the
one-real-verdict rule. The output specification comment and the README gain
the skipped case, the README's rendered from the real renderer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9zFxq8V4qxG4aMzJhGBFn

Review found the same defect this PR set out to fix, one layer down.

run_commit_check has always failed only on "fail", but add_job_summary,
add_pr_comments (two call sites) and set_result_output each asked
`all(scope.status == "pass")` instead. Those were equivalent only while
pass and fail were the only statuses. With skip added, a skipped-only run
rendered "⊘ All N checks skipped" and then exited 1 and emitted result
status "fail" -- a bypassed policy turned into a broken build.

Four copies of a two-state assumption is the same shape as the four copies
of the reduce-to-overall rule in commit-check#537, so it gets the same
remedy: overall_status() and exit_code_for(), defined once and used by
every path.

Three smaller findings, all real:

* _markdown_table skipped only `pass` scopes, so a run with both a failure
  and a skip added a row with no value and no rule links -- a blank
  accusation under a "Failed checks" heading. It now takes failures only.
* The all-skipped verdict fired on an empty result set, where
  `skipped == total` is trivially true, reporting "All 0 checks skipped".
  It now requires a scope, matching the guard the step log already had.
* The step log said "all checks passed (2 skipped)" for a partial skip,
  contradicting its own report headline. It now reads
  "2 of 3 checks passed, 1 skipped".

Each fix is pinned by a test that fails when the fix is reverted, checked
one at a time.

Not changed: the requirements.txt pin. The README documents 2.13.4 as the
minimum for ⊘ to appear, and 2.13.4 does not exist yet -- commit-check#537
is still open. Pinning it now would install a version that cannot be
resolved. The rendering is back-compatible by construction, so the bump
belongs with the release, not here.

The subject avoids "treat", which reads as imperative but is absent from
the 396-verb list in commit-check 2.13.1 -- the version this action still
pins. It was added by commit-check#527 and shipped in 2.13.2, so the
whitelist on the runner is three releases behind the project's own. The
pin bump in #258 fixes that; this only sidesteps it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9zFxq8V4qxG4aMzJhGBFn

PR #258 in this repository reported "All 5 checks passed" over five green
ticks while validating nothing: its author is dependabot[bot], which the
org config lists in ignore_authors, so every rule was bypassed. The report
had no way to say so -- ScopeResult knew only pass and fail, and a skip
arrived looking exactly like a pass.

The bare labels in that summary were the only hint anything was different,
and only because a skipped check reports no value. That was incidental, not
a signal.

commit-check 2.13.4 reports "status": "skip", so this consumes it:

  * ScopeResult.status gains "skip", set when every check in the scope
    skipped. One real verdict outranks the skips.
  * Skipped scopes render "⊘ <label> (skipped)" -- deliberately not a ✔,
    and with no value, because nothing was examined.
  * The headline distinguishes the three cases. All skipped reads
    "⊘ All N checks skipped — nothing was validated"; a partial skip reads
    "✅ 3 of 5 checks passed, 2 skipped" rather than claiming all passed.
  * The step log line follows the same rule.

Back-compatible by construction: against an engine that never emits "skip"
no branch here is reachable, and a test pins that the old rendering is
unchanged.

Adds a golden test for the fully skipped report so the layout stays exact,
alongside tests for the partial-skip headline, failure precedence, and the
one-real-verdict rule. The output specification comment and the README gain
the skipped case, the README's rendered from the real renderer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9zFxq8V4qxG4aMzJhGBFn

Review found the same defect this PR set out to fix, one layer down.

run_commit_check has always failed only on "fail", but add_job_summary,
add_pr_comments (two call sites) and set_result_output each asked
`all(scope.status == "pass")` instead. Those were equivalent only while
pass and fail were the only statuses. With skip added, a skipped-only run
rendered "⊘ All N checks skipped" and then exited 1 and emitted result
status "fail" -- a bypassed policy turned into a broken build.

Four copies of a two-state assumption is the same shape as the four copies
of the reduce-to-overall rule in commit-check#537, so it gets the same
remedy: overall_status() and exit_code_for(), defined once and used by
every path.

Three smaller findings, all real:

* _markdown_table skipped only `pass` scopes, so a run with both a failure
  and a skip added a row with no value and no rule links -- a blank
  accusation under a "Failed checks" heading. It now takes failures only.
* The all-skipped verdict fired on an empty result set, where
  `skipped == total` is trivially true, reporting "All 0 checks skipped".
  It now requires a scope, matching the guard the step log already had.
* The step log said "all checks passed (2 skipped)" for a partial skip,
  contradicting its own report headline. It now reads
  "2 of 3 checks passed, 1 skipped".

Each fix is pinned by a test that fails when the fix is reverted, checked
one at a time.

Not changed: the requirements.txt pin. The README documents 2.13.4 as the
minimum for ⊘ to appear, and 2.13.4 does not exist yet -- commit-check#537
is still open. Pinning it now would install a version that cannot be
resolved. The rendering is back-compatible by construction, so the bump
belongs with the release, not here.

The subject avoids "treat", which reads as imperative but is absent from
the 396-verb list in commit-check 2.13.1 -- the version this action still
pins. It was added by commit-check#527 and shipped in 2.13.2, so the
whitelist on the runner is three releases behind the project's own. The
pin bump in #258 fixes that; this only sidesteps it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9zFxq8V4qxG4aMzJhGBFn

* feat: render a skipped check as skipped, not as a green tick

PR #258 in this repository reported "All 5 checks passed" over five green
ticks while validating nothing: its author is dependabot[bot], which the
org config lists in ignore_authors, so every rule was bypassed. The report
had no way to say so -- ScopeResult knew only pass and fail, and a skip
arrived looking exactly like a pass.

The bare labels in that summary were the only hint anything was different,
and only because a skipped check reports no value. That was incidental, not
a signal.

commit-check 2.13.4 reports "status": "skip", so this consumes it:

  * ScopeResult.status gains "skip", set when every check in the scope
    skipped. One real verdict outranks the skips.
  * Skipped scopes render "⊘ <label> (skipped)" -- deliberately not a ✔,
    and with no value, because nothing was examined.
  * The headline distinguishes the three cases. All skipped reads
    "⊘ All N checks skipped — nothing was validated"; a partial skip reads
    "✅ 3 of 5 checks passed, 2 skipped" rather than claiming all passed.
  * The step log line follows the same rule.

Back-compatible by construction: against an engine that never emits "skip"
no branch here is reachable, and a test pins that the old rendering is
unchanged.

Adds a golden test for the fully skipped report so the layout stays exact,
alongside tests for the partial-skip headline, failure precedence, and the
one-real-verdict rule. The output specification comment and the README gain
the skipped case, the README's rendered from the real renderer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9zFxq8V4qxG4aMzJhGBFn

* fix: stop reporting a skipped run as a failure

Review found the same defect this PR set out to fix, one layer down.

run_commit_check has always failed only on "fail", but add_job_summary,
add_pr_comments (two call sites) and set_result_output each asked
`all(scope.status == "pass")` instead. Those were equivalent only while
pass and fail were the only statuses. With skip added, a skipped-only run
rendered "⊘ All N checks skipped" and then exited 1 and emitted result
status "fail" -- a bypassed policy turned into a broken build.

Four copies of a two-state assumption is the same shape as the four copies
of the reduce-to-overall rule in commit-check#537, so it gets the same
remedy: overall_status() and exit_code_for(), defined once and used by
every path.

Three smaller findings, all real:

* _markdown_table skipped only `pass` scopes, so a run with both a failure
  and a skip added a row with no value and no rule links -- a blank
  accusation under a "Failed checks" heading. It now takes failures only.
* The all-skipped verdict fired on an empty result set, where
  `skipped == total` is trivially true, reporting "All 0 checks skipped".
  It now requires a scope, matching the guard the step log already had.
* The step log said "all checks passed (2 skipped)" for a partial skip,
  contradicting its own report headline. It now reads
  "2 of 3 checks passed, 1 skipped".

Each fix is pinned by a test that fails when the fix is reverted, checked
one at a time.

Not changed: the requirements.txt pin. The README documents 2.13.4 as the
minimum for ⊘ to appear, and 2.13.4 does not exist yet -- commit-check#537
is still open. Pinning it now would install a version that cannot be
resolved. The rendering is back-compatible by construction, so the bump
belongs with the release, not here.

The subject avoids "treat", which reads as imperative but is absent from
the 396-verb list in commit-check 2.13.1 -- the version this action still
pins. It was added by commit-check#527 and shipped in 2.13.2, so the
whitelist on the runner is three releases behind the project's own. The
pin bump in #258 fixes that; this only sidesteps it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9zFxq8V4qxG4aMzJhGBFn

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>