From eaec535b559342f221e80ec44147b4cccd2ccb02 Mon Sep 17 00:00:00 2001
From: Artem Safronov <122199423+Yhooi2@users.noreply.github.com>
Date: Sat, 13 Jun 2026 18:24:10 +0300
Subject: [PATCH] =?UTF-8?q?ci(audit-self):=20warn-only=20trailer-backstop?=
 =?UTF-8?q?=20on=20staging=E2=86=92main=20promotions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pr-commit-trailers backstop hard-fails on every staging→main promotion:
the main..staging range (134 commits) inevitably includes trailerless commits
(dependabot version bumps, merge commits), so the gate is permanently red and
trains routine `gh pr merge --admin` override — the #discipline-theatre the
project exists to prevent. Enforcement already happens at each feature→staging
merge (this same job runs there); the promotion re-check is redundant.

Make the two hard-enforce steps continue-on-error ONLY on promotion
(head=staging && base=main). The steps still run and log violations (the
record is preserved), but no longer block the job. All non-promotion PRs keep
full hard enforcement.

§1.7: forward-check applied — complies with no-paid-llm-in-ci (deterministic, no LLM in this gate) and reviewer-discipline (this enforcement edit is maintainer-reviewed via PR, not self-merged); backward-check sweep — relaxes only the promotion branch of pr-commit-trailers (.github/workflows/audit-self.yml:357), feature→staging enforcement unchanged, no other gate touched.
Prior-art: skipped — CI workflow conditional edit (promotion exemption); no new capability, dependency, or code module added.
---
 .github/workflows/audit-self.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/audit-self.yml b/.github/workflows/audit-self.yml
index b6c10a6f3..84cf6f193 100644
--- a/.github/workflows/audit-self.yml
+++ b/.github/workflows/audit-self.yml
@@ -348,12 +348,22 @@ jobs:
           git rev-parse --verify "origin/${BASE_REF}" >/dev/null \
             || { echo "::error::base ref origin/${BASE_REF} not resolvable — refusing to skip the backstop"; exit 1; }
       - name: §1.7 discipline-trailer check over PR commits (hard-enforced)
+        # Promotion exemption: a staging→main PR re-checks the SAME commits this
+        # job already enforced at each feature→staging merge (it runs there too).
+        # The 134-commit promotion range inevitably includes trailerless commits
+        # (dependabot bumps, merge commits), so promotions are ALWAYS red and
+        # train routine admin-override (#discipline-theatre). Tolerate failures on
+        # promotion ONLY — the step still runs and logs violations (record kept),
+        # but no longer blocks. All non-promotion PRs keep hard enforcement.
+        continue-on-error: ${{ github.base_ref == 'main' && github.head_ref == 'staging' }}
         env:
           S17_WARN_ONLY: 'false'
           S17_SUBSTANCE_WARN_ONLY: 'false'
           PREPUSH_UPSTREAM_REF: origin/${{ github.base_ref }}
         run: PREPUSH_ONLY=s17 npx tsx packages/core/hooks/pre-push.ts
       - name: §7 Prior-art trailer check over PR commits (base blocks; substance warn-only per Option B)
+        # Same promotion exemption as the §1.7 step above (head=staging && base=main).
+        continue-on-error: ${{ github.base_ref == 'main' && github.head_ref == 'staging' }}
         env:
           PREPUSH_UPSTREAM_REF: origin/${{ github.base_ref }}
         run: PREPUSH_ONLY=prior-art npx tsx packages/core/hooks/pre-push.ts