Summary
In the reusable repo-required-gate.yml, every downstream lane (node-ci, go-ci, python-ci, workflow-validation, policy-validation, dependency-review, snapshot-validation) is gated on PR-contract success via:
needs: [detect, pr-contract]
if: ... && (github.event_name != 'pull_request' || inputs.run-pr-contract == false || needs.pr-contract.result == 'success')
When a PR body fails the contract, pr-contract fails, and that clause makes every lane skip. The decision job then requires node ci == success, sees skipped, and emits a misleading node ci ... required but result was skipped — while no real CI ever ran. A malformed PR body therefore silently suppresses all validation.
Impact
Consumers pinned to @v1 admin-merged PRs without real CI signal. Surfaced downstream as ArchonVII/archon#200; Archon worked around it locally (run-pr-contract: false + a sibling contract job) in ArchonVII/archon#202, but the defect lives here at the source.
Fix
Decouple the lanes from the contract: lanes depend on detect alone; the decision job stays the single aggregator that requires both the contract and the lanes. A bad body still blocks merge — now with real lane signal instead of a phantom skip.
Rollout
After merge, advance the moving v1 tag to the merged commit so consumers pinned to @v1 pick up the fix.
Summary
In the reusable
repo-required-gate.yml, every downstream lane (node-ci,go-ci,python-ci,workflow-validation,policy-validation,dependency-review,snapshot-validation) is gated on PR-contract success via:When a PR body fails the contract,
pr-contractfails, and that clause makes every lane skip. Thedecisionjob then requiresnode ci == success, seesskipped, and emits a misleadingnode ci ... required but result was skipped— while no real CI ever ran. A malformed PR body therefore silently suppresses all validation.Impact
Consumers pinned to
@v1admin-merged PRs without real CI signal. Surfaced downstream as ArchonVII/archon#200; Archon worked around it locally (run-pr-contract: false+ a sibling contract job) in ArchonVII/archon#202, but the defect lives here at the source.Fix
Decouple the lanes from the contract: lanes depend on
detectalone; thedecisionjob stays the single aggregator that requires both the contract and the lanes. A bad body still blocks merge — now with real lane signal instead of a phantom skip.Rollout
After merge, advance the moving
v1tag to the merged commit so consumers pinned to@v1pick up the fix.