The whole fleet pins hydra-gates-ref: v1.0.1, which predates #147/#148/#149 — 16 dead gates are still live in CI everywhere

[rubenvdlinde]

All 22 repos that set enable-hydra-gates: true also pin:

hydra-gates-ref: v1.0.1

v1.0.1 is f4d9756 (2026-08-03). Everything since is invisible to CI:

commit	tag	in v1.0.1?
f4d9756 fix(gate-4): audit the LOCK (#135)	v1.0.1	✅
d9645e3 gate-53 ignored the diff scope; gate-22 printed FAIL — 0; gate-33 had never run (#139)	v1.1.0	❌
549ad1a 16 gates reported PASS when their helper never ran (#147)	—	❌
0d3e589 produce tests/axe/report.json so gate-33 can actually run (#148)	—	❌
fc70ea6 gate-7 follows delegation; gates 6/7 stop passing on an empty scope (#149)	—	❌

So every in-CI Hydra Gates run on the fleet today is executing a script in which 16 gates report PASS when their helper never ran, and in which gates 6 and 7 report PASS on an empty scope. That is the dead-gate shape those PRs were written to close, still live everywhere.

Confirmed for: app-versions, decidesk, docudesk, doriath, hermiq, larpingapp, launchpad, nextcloud-app-template, nldesign, openbuild, opencatalogi, openconnector, openregister, petstore, pipelinq, planix, portaliq, procest, scholiq, shillinq, softwarecatalog, zaakafhandelapp.

$ for r in …; do gh api repos/ConductionNL/$r/contents/.github/workflows/code-quality.yml?ref=development \
    -q .content | base64 -d | grep hydra-gates-ref; done
hydra-gates-ref: v1.0.1     # ×22, no exceptions

Two things needed:

1. Cut a tag containing fix(gates): 16 gates reported PASS when their helper never ran — 2 are authorization gates #147/feat(quality): produce tests/axe/report.json so gate-33 (axe-core) can actually run #148/fix(hydra-gates): gate-7 follows delegation; gates 6/7 stop passing on an empty scope #149 (v1.2.0) and bump the fleet to it. v1.1.0 is not enough — it predates all three.
2. Decide whether the pin should be a moving minor (v1) rather than an exact patch. A patch pin means every gate fix needs a 22-repo bump PR wave, which is exactly why the fleet is 4 fixes behind after two days.

Related: the full-tree numbers I am reporting elsewhere use main, so they are not comparable to what CI prints today — worth stating explicitly wherever both appear.