Unblock required-workflow source repository PRs without weakening organization gates

[seonghobae]

Incident

The organization ruleset requires the OpenCode and Noema workflows sourced from ContextualWisdomLab/.github, and the ruleset also targets the .github repository's own default branch. A central bootstrap repair therefore cannot currently satisfy the two workflow contexts sourced from the same repository.

Exact example: PR #731, head c73ee47861fca21e6959ce80fdf57b434c715c9d.

• all eight repository-owned exact-head workflows have successful runs on the unchanged head: CodeQL, Semgrep, Security Scan, Python Security, OSV, Scorecard, Secret Scan, and SBOM;
• auto-merge is enabled;
• direct guarded merge reports: 2 of 15 required status checks are expected and New changes require approval from someone other than the last pusher;
• no OpenCode or Noema review/check was published after a fresh ready-for-review PR was opened on the exact head;
• comments requesting both reviewer Apps produced no review because their execution is workflow-driven.

GitHub's documented source-repository boundary

GitHub's ruleset troubleshooting documentation calls out required-workflow source repositories explicitly. For workflows intended to run through a ruleset, GitHub recommends choosing a deliberate source-repository configuration, such as adding an unconditional job condition, disabling the local workflow in the source repository, or disabling Actions there. It also recommends Evaluate mode or an authorized bypass for bootstrap situations where the required workflow cannot run.

Primary documentation:

• https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/troubleshooting-rules#supported-directory
• https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#using-evaluate-mode-for-ruleset-workflows

Required administrative decision

Choose and implement one fail-closed pattern for the .github source repository:

1. exclude only ContextualWisdomLab/.github from the organization required-workflow targets while keeping its direct CodeQL/Semgrep/Security/Python/OSV/Scorecard/Secret/SBOM checks plus independent review rules; or
2. put the required-workflow rules in Evaluate mode long enough to merge the validated bootstrap repair, then return them to Active after proving they execute; or
3. configure the source repository/local workflow behavior according to GitHub's supported-directory guidance so the same OpenCode/Noema contexts are actually emitted for .github PRs.

Do not synthesize statuses, remove independent review, or weaken the organization rules for target application repositories.

Acceptance evidence

• PR fix(ci): restore central review, security, snapshots, and hourly repair #731 publishes the exact expected OpenCode and Noema contexts on its current head;
• independent reviewer App approval is attached to that head;
• fix(ci): restore central review, security, snapshots, and hourly repair #731 merges through normal branch protection;
• newsdom-api#467 is then re-reviewed through the repaired central coverage path and merges without a manual bypass;
• the final configuration and rollback procedure are recorded in docs/org-required-workflow-rollout.md and covered by a contract test where repository-level configuration can be represented in source.

[seonghobae]

Fresh evidence on 2026-08-04: #731 is back on its clean exact source head c73ee47861fca21e6959ce80fdf57b434c715c9d. Seven of the eight direct PR workflows have a fresh successful run; the remaining CodeQL run is queued, while earlier exact-head CodeQL runs are successful. A guarded merge still reports New changes require approval from someone other than the last pusher plus four unsatisfied required contexts, including one expected ruleset workflow. GitHub's ruleset troubleshooting guidance also says ruleset workflows should not use cancel-in-progress; both current OpenCode and Noema entrypoints do. The source-repository configuration/evaluate-mode decision remains necessary before the clean bootstrap can merge without synthesizing statuses.