Context
scripts/check-stuck-required-checks.mjs:24:
export const REQUIRED_CONTEXTS = new Set(["validate", "Superagent Security Scan"]);
The in-file comment explains this can't be read live from branch protection (permissions limitation) and must be updated by hand. This is a real, silent-drift-prone pattern: if main's required-checks list changes (a new required job is added) without a matching manual edit here, this watchdog — built after a real incident to catch hung required checks — will simply never flag the new job when it hangs, with no error or CI signal anywhere. This is distinct from the milestone's earlier "forbidden-content.mjs missing secret formats" finding — this is a required-check name list, not a secret-pattern list, and the file is otherwise well-tested.
Requirements
Add a lightweight regression test (or CI-time check) that fails loudly when REQUIRED_CONTEXTS diverges from the actual job names declared in .github/workflows/ci.yml (and any other workflow contributing a required check), forcing an intentional update to this file instead of a silent drift. Scope is a detection/test mechanism only — do not change how required checks are enforced or configured, only how this watchdog's own hardcoded list stays honest.
Deliverables
Test Coverage Requirements
This issue's deliverable is itself a test — no separate coverage requirement beyond the new test passing and genuinely failing when the lists are made to diverge (verify locally before submitting).
Expected Outcome
Adding or renaming a required CI check without updating REQUIRED_CONTEXTS now fails a test immediately instead of silently disabling the stuck-check watchdog for that check.
Links & Resources
scripts/check-stuck-required-checks.mjs:24, .github/workflows/ci.yml (the source of truth this list must stay in sync with)
Context
scripts/check-stuck-required-checks.mjs:24:The in-file comment explains this can't be read live from branch protection (permissions limitation) and must be updated by hand. This is a real, silent-drift-prone pattern: if
main's required-checks list changes (a new required job is added) without a matching manual edit here, this watchdog — built after a real incident to catch hung required checks — will simply never flag the new job when it hangs, with no error or CI signal anywhere. This is distinct from the milestone's earlier "forbidden-content.mjs missing secret formats" finding — this is a required-check name list, not a secret-pattern list, and the file is otherwise well-tested.Requirements
Add a lightweight regression test (or CI-time check) that fails loudly when
REQUIRED_CONTEXTSdiverges from the actual job names declared in.github/workflows/ci.yml(and any other workflow contributing a required check), forcing an intentional update to this file instead of a silent drift. Scope is a detection/test mechanism only — do not change how required checks are enforced or configured, only how this watchdog's own hardcoded list stays honest.Deliverables
test/unit/or wherever this repo's script tests live) that parses job names out of the relevant workflow YAML and asserts they matchREQUIRED_CONTEXTS, failing with a clear message if they diverge.Test Coverage Requirements
This issue's deliverable is itself a test — no separate coverage requirement beyond the new test passing and genuinely failing when the lists are made to diverge (verify locally before submitting).
Expected Outcome
Adding or renaming a required CI check without updating
REQUIRED_CONTEXTSnow fails a test immediately instead of silently disabling the stuck-check watchdog for that check.Links & Resources
scripts/check-stuck-required-checks.mjs:24,.github/workflows/ci.yml(the source of truth this list must stay in sync with)