fix:corrected workflows issue

Author: xkilldash9x

.github/workflows/semantic_analysis.yml

@@ -13,7 +13,7 @@ jobs:
   analysis:
     name: Run Analysis
     runs-on: ubuntu-latest
-    
+
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -28,6 +28,7 @@ jobs:
           cache: true
 
       - name: Build SFW
+        # Building strictly from source to ensure binary integrity before execution.
         run: |
           mkdir -p bin
           CGO_ENABLED=0 go build -o bin/sfw ./cmd/sfw
@@ -56,21 +57,21 @@ jobs:
             BASE_REF=$(git merge-base origin/main HEAD)
             HEAD_REF="HEAD"
           fi
-          
+
           # 2. Setup Base Worktree
           # We create the worktree in the workspace so it is mounted into the sandbox.
           WORKTREE_DIR=".sfw_base"
           # Clean up previous run if exists
           rm -rf "$WORKTREE_DIR"
           git worktree add --detach "$WORKTREE_DIR" "$BASE_REF"
-          
+
           echo "worktree_dir=$WORKTREE_DIR" >> $GITHUB_OUTPUT
 
           # 3. Pre-calculate Diff (CRITICAL HARDENING)
           # We run git on the host (where it works) and save the status to a file.
           # The sandbox will simply read this file, avoiding "dubious ownership" errors.
           git diff -z --name-status "$BASE_REF" "$HEAD_REF" > diff_stream.bin
-          
+
           # Check for Go files to fail fast if none exist
           if git diff --name-only "$BASE_REF" "$HEAD_REF" | grep -q '\.go$'; then
              echo "has_go_files=true" >> $GITHUB_OUTPUT
@@ -80,13 +81,16 @@ jobs:
 
       - name: Run Semantic Analysis (Sandboxed)
         uses: geomys/sandboxed-step@v1.2.0
+        # FIX: 'env' must be a sibling to 'with', not a child.
+        # This injects the vars into the process environment where the sandbox can see them.
+        env:
+          MODE: ${{ steps.mode.outputs.mode }}
+          WORKTREE_DIR: ${{ steps.prep.outputs.worktree_dir }}
+          HAS_GO: ${{ steps.prep.outputs.has_go_files }}
         with:
           disable-network: 'true'
-          # We pass environment variables for safety, preventing script injection
-          env:
-            MODE: ${{ steps.mode.outputs.mode }}
-            WORKTREE_DIR: ${{ steps.prep.outputs.worktree_dir }}
-            HAS_GO: ${{ steps.prep.outputs.has_go_files }}
+          # Assuming 'run' is a valid input parameter for geomys/sandboxed-step.
+          # If this action does not support a 'run' input, you must use 'entrypoint'.
           run: |
             set -euo pipefail
 
@@ -156,15 +160,15 @@ jobs:
                   echo "| \`$OLD_FILE_REF\` | Deleted | N/A |" >> $GITHUB_STEP_SUMMARY
                   continue
               fi
-              
+
               # Execute SFW using the local binary built in the previous step
               # We use '|| true' to capture exit codes without crashing the script (due to set -e)
               if ! OUTPUT=$(./bin/sfw diff "$OLD_FILE" "$NEW_FILE"); then
                   echo "::error::sfw failed to process $NEW_FILE_REF"
                   ERROR_COUNT=$((ERROR_COUNT + 1))
                   continue
               fi
-              
+
               # Validate JSON
               if ! echo "$OUTPUT" | jq -e . >/dev/null 2>&1; then
                   echo "::error::Invalid JSON output for $NEW_FILE_REF"
@@ -175,14 +179,14 @@ jobs:
               # Parse Results using jq (replaces 'bc' dependency)
               PCT=$(echo "$OUTPUT" | jq -r '.summary.semantic_match_pct // 0')
               MODIFIED=$(echo "$OUTPUT" | jq -r '.summary.modified // 0')
-              
+
               # Logic check using jq to avoid floating point issues in shell
               IS_BELOW_100=$(echo "$OUTPUT" | jq -r 'if (.summary.semantic_match_pct // 0) < 100 then "true" else "false" end')
 
-              if [ "$IS_BELOW_100" == "true" ]; then
+              if [ "$IS_BELOW_100" = "true" ]; then
                   STATUS_ICON="Modified ($MODIFIED)"
                   echo "| \`$NEW_FILE_REF\` | $STATUS_ICON | **$PCT%** |" >> $GITHUB_STEP_SUMMARY
-                  
+
                   if [ "$MODE" == "BLOCKER" ]; then
                       echo "::error file=$NEW_FILE_REF::Logic change detected in safe refactor! ($PCT%)"
                       LOGIC_FAIL=1