fix(drift): enforce real green-gate before auto-merge (pass>0, required contexts, no false-green)

[jpr5]

What & why

The in-workflow auto-merge "green gate" in fix-drift.yml did not actually enforce green. It counted gh pr checks | wc -l rows (a "no checks reported" message is itself a row) and relied on gh pr checks --watch --fail-fast, which exits 0 on empty / pending / skipped / neutral. That is a false-green: an unverified drift PR could auto-merge to main. This fix-forward replaces the gate with a real, testable assertion.

Findings addressed

1. CRITICAL — false-green gate. Replaced row-count + --watch-exit-0 with a machine-readable assertion: poll on gh pr checks --json length for registration, --watch under a hard timeout, then re-query JSON and require pass>=1 AND zero in {pending, fail, cancel}. neutral/skipped do not count toward pass.
2. CRITICAL — required contexts present. Gate asserts the expected required contexts (prettier, eslint, exports, commitlint, test (20/22/24), agui-schema-drift, drift-live-pr, zizmor — derived from the real check set on drift PR Fix Drift: authenticate via copilotkit-devops-bot app token #305) are present and concluded green, so one unrelated fast check can't satisfy the gate and a registration race can't slip an incomplete set through.
3. HIGH — wrong-PR risk. Select the PR by head-SHA match (headRefOid == git rev-parse HEAD), not gh pr list ... .[0]. Added set -euo pipefail to the multi-command run blocks.
4. HIGH — checks:read. Added checks: read + statuses: read to the job permissions: and to the minted app-token permissions.
5. HIGH — masked autofix failure. continue-on-error: true autofix that fails now triggers a distinct "autofix STEP failed" Slack alert and fails the job (steps.autofix.outcome != 'success').
6. HIGH — exit-5 quarantine silent skip. Collector exit 5 now sets a quarantine=true output and routes to a distinct "drift quarantine — needs human" Slack alert instead of the silent skip path.
7. MED — Slack correctness/coverage. Success message says "merged to main" only when the merge command returned 0 (merged=true output); otherwise "PR open, not yet merged". Missing SLACK_WEBHOOK on the failure path is now a visible ::error:: annotation, not a silent exit 0. Dropped curl -s for curl -fsS --show-error.
8. MED — watch timeout. --watch wrapped in timeout 1200; the failure Slack distinguishes timeout / not-green / no-checks reasons.

Design

The gate decision is factored into a standalone, unit-testable script scripts/ci-merge-gate.sh that reads the gh pr checks --json name,state,bucket array (file arg or stdin) and exits 0 only on true-green. The workflow calls this script as the authoritative decision (the --watch exit status is advisory only). Required contexts default to the drift-PR set and are overridable via REQUIRED_CONTEXTS.

Red-green proof

The gate is exercised by src/__tests__/ci-merge-gate.test.ts (13 tests) plus a direct shell comparison.

RED — OLD workflow logic (row-count + --watch) treats false-green as mergeable

[a-empty]          OLD gate => WOULD MERGE (rows=1, watch exit 0)  <-- FALSE GREEN
[b-pending]        OLD gate => WOULD MERGE (rows=1, watch exit 0)  <-- FALSE GREEN
[c-skipped]        OLD gate => WOULD MERGE (rows=2, watch exit 0)  <-- FALSE GREEN
[d-unrelated-pass] OLD gate => WOULD MERGE (rows=1, watch exit 0)  <-- FALSE GREEN

GREEN — NEW gate (scripts/ci-merge-gate.sh)

[a-empty]          NEW gate => REFUSE (exit 1)  <-- correctly blocked
[b-pending]        NEW gate => REFUSE (exit 1)  <-- correctly blocked
[c-skipped]        NEW gate => REFUSE (exit 1)  <-- correctly blocked
[d-unrelated-pass] NEW gate => REFUSE (exit 1)  <-- correctly blocked
[e-all-green]      NEW gate => ACCEPT (exit 0)

vitest

 ✓ src/__tests__/ci-merge-gate.test.ts (13 tests)
   ci-merge-gate.sh — RED: old logic treats false-green as mergeable
     ✓ (a) empty/no-checks — OLD gate would MERGE
     ✓ (b) pending-only — OLD gate would MERGE
     ✓ (c) skipped/neutral-only — OLD gate would MERGE
     ✓ (d) one unrelated pass, required missing — OLD gate would MERGE
   ci-merge-gate.sh — GREEN: new gate refuses false-green, accepts true-green
     ✓ (a) empty/no-checks — REFUSES (exit 1)
     ✓ (b) pending-only — REFUSES (exit 1)
     ✓ (c) skipped/neutral-only — REFUSES (exit 1) and does not count skips as pass
     ✓ (d) one unrelated pass with required missing — REFUSES (exit 1)
     ✓ (e) all-required-green (extras skipped) — ACCEPTS (exit 0)
     ✓ fails when a required context is in the fail bucket
     ✓ fails when a required context is still pending even if others pass
     ✓ honors REQUIRED_CONTEXTS override (comma-separated)
     ✓ derives bucket from raw state when bucket field is absent
 Test Files  1 passed (1)
      Tests  13 passed (13)

Local verification

• actionlint .github/workflows/fix-drift.yml — clean
• shellcheck scripts/ci-merge-gate.sh — clean
• pnpm format:check — clean
• pnpm lint — clean
• gate re-validated against real PR Fix Drift: authenticate via copilotkit-devops-bot app token #305 JSON (all-required-green) => exit 0

Scope

Diff touches only: .github/workflows/fix-drift.yml, scripts/ci-merge-gate.sh, src/__tests__/ci-merge-gate.test.ts. No ruleset, secret, or GitHub App / bypass-config changes.

Opened as DRAFT — do not merge; orchestrator gates the merge.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@copilotkit/aimock@306

commit: 0479f9a