claw-sarif: ask for no token without a changed .t27, degrade to a step-summary note when the App cannot mint one (Closes #10501)

.github/workflows/gate-topology.yml

@@ -115,19 +115,21 @@ jobs:
   # claw/sarif: a changed .t27 spec that does not parse, or declares functions with no body, becomes a code-scanning
   # alert from the TRI CLAW App. The law is specs/claw/sarif_feed.t27 (gen/c/claw/sarif_feed.c); this job mints the
   # token (security_events write + contents read, the code-scanning-sarif row of specs/claw/github_surface.t27),
-  # runs the signed t27o release t27c over the changed specs and uploads what the law prints.
+  # runs the signed t27o release t27c over the changed specs and uploads what the law prints. #10501: no token is asked for
+  # when no .t27 changed, and an installation without security_events write leaves a step-summary note, never a red job.
   claw-sarif:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-24.04
-    permissions: {contents: read}
+    permissions: {contents: read, pull-requests: read}
     steps:
       - id: have
-        env: {K: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", I: "${{ vars.CLAW_APP_ID }}"}
-        run: if [ -n "$K" ] && [ -n "$I" ]; then echo ok=1 >> "$GITHUB_OUTPUT"; else echo "claw/sarif uploaded nothing - secret CLAW_APP_PRIVATE_KEY or variable CLAW_APP_ID is not set (docs/claw/README.md)." >> "$GITHUB_STEP_SUMMARY"; fi
-      - {id: tok, if: steps.have.outputs.ok, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-security-events: write, permission-contents: read}}
-      - {if: steps.have.outputs.ok, uses: actions/checkout@v6, with: {fetch-depth: 2}}
-      - {if: steps.have.outputs.ok, uses: sigstore/cosign-installer@v3}
-      - if: steps.have.outputs.ok
+        env: {K: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", I: "${{ vars.CLAW_APP_ID }}", GH_TOKEN: "${{ github.token }}", R: "${{ github.repository }}", N: "${{ github.event.pull_request.number }}"}
+        run: gh api --paginate "repos/$R/pulls/$N/files" --jq '.[]|select(.status!="removed")|.filename|select(endswith(".t27"))' > /tmp/t27s; if [ ! -s /tmp/t27s ]; then echo "claw/sarif asked for no token - this pull request changes no .t27 file." >> "$GITHUB_STEP_SUMMARY"; elif [ -n "$K" ] && [ -n "$I" ]; then echo ok=1 >> "$GITHUB_OUTPUT"; else echo "claw/sarif uploaded nothing - secret CLAW_APP_PRIVATE_KEY or variable CLAW_APP_ID is not set (docs/claw/README.md)." >> "$GITHUB_STEP_SUMMARY"; fi
+      - {id: tok, if: steps.have.outputs.ok, continue-on-error: true, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-security-events: write, permission-contents: read}}
+      - {if: steps.tok.outcome == 'failure', run: echo "claw/sarif uploaded nothing - the TRI CLAW App could not mint a token with security_events write; grant it and accept it on the installation - docs/claw/README.md steps 1-2." >> "$GITHUB_STEP_SUMMARY"}
+      - {if: steps.tok.outputs.token, uses: actions/checkout@v6, with: {fetch-depth: 2}}
+      - {if: steps.tok.outputs.token, uses: sigstore/cosign-installer@v3}
+      - if: steps.tok.outputs.token
         env: {V: t27o-v0.1.0}
         run: |
           cd /tmp; B=https://github.com/gHashTag/t27/releases/download/$V
@@ -136,7 +138,7 @@ jobs:
           sha256sum -c --ignore-missing checksums-$V.txt; chmod +x t27c; cd "$GITHUB_WORKSPACE"
           printf '#include "gen/c/claw/sarif_feed.c"\n#include <stdio.h>\n#include <stdlib.h>\nint main(void){size_t k=1<<22,n;uint8_t*b=malloc(k),*o=malloc(k);n=fread(b,1,k,stdin);size_t m=feed_sarif(b,n,o,k);if(n==k||m>k)return 3;fwrite(o,1,m,stdout);return 0;}\n' | cc -O1 -w -I . -x c -o /tmp/feed -
           git diff --name-only --diff-filter=d HEAD^1 HEAD -- '*.t27' | while read -r f; do printf '%s\t%s\t%s\n' "$f" "$(/tmp/t27c spec-status "$f" 2>&1 </dev/null | tail -1)" "$(/tmp/t27c parse "$f" 2>&1 >/dev/null </dev/null | head -1)"; done | /tmp/feed > /tmp/claw.sarif
-      - {if: steps.have.outputs.ok, uses: github/codeql-action/upload-sarif@v4, with: {sarif_file: /tmp/claw.sarif, category: claw/sarif, token: "${{ steps.tok.outputs.token }}"}}
+      - {if: steps.tok.outputs.token, uses: github/codeql-action/upload-sarif@v4, with: {sarif_file: /tmp/claw.sarif, category: claw/sarif, token: "${{ steps.tok.outputs.token }}"}}
 
   # claw/suggest: a changed .t27 spec that `t27c fmt` (specs/tri/fmt_source.t27, whitespace only) would reformat becomes a
   # suggestion review from the TRI CLAW App. Placement is specs/claw/suggest.t27, the driver is specs/claw/suggest_feed.t27

MIGRATION_AUDIT.md

@@ -50,7 +50,7 @@ centralization in the `tri` CLI, per issue #592.
 | `conformance/kepler_newton_tests.py` | C | Keep | Conformance helper not on gate. |
 | `test_notebooklm.py`, `test_notebooklm_venv.sh` | C | Keep | Manual smoke tests at repo root. |
 | `scripts/tri-*.py`, `scripts/audit_discovery.py`, `scripts/check_first_party_doc_language.py`, `scripts/verify_*.py`, `scripts/lee_*.py`, `scripts/compare_*.py`, `scripts/fix_*.py`, `scripts/overnight_research_agent.py`, `scripts/print_pellis_seal_decimal.py`, `scripts/unified_search_all.py`, `scripts/wrapup/*.py` | C | Keep | Standalone helpers; none referenced from `.githooks/` or commit-path workflows. |
-| `scripts/install-*.sh`, `scripts/setup-git-hooks.sh`, `scripts/auto-*.sh`, `scripts/check-conflicts.sh`, `scripts/bulk-create-notebooks.sh`, `scripts/generate_episodes.sh`, `scripts/git_commands_tasks_1_4.sh`, `scripts/mcp-wrapper.sh`, `scripts/phi-loop-stack.sh`, `scripts/run_v51_multiple.sh`, `scripts/test-agent-bridge.sh`, `scripts/verify-notebooklm.sh`, `scripts/verify-ssot-integration.sh` | C | Keep | One-shot setup / human-invoked utilities; not gated. |
+| `scripts/install-*.sh`, `scripts/setup-git-hooks.sh`, `scripts/auto-*.sh`, `scripts/check-conflicts.sh`, `scripts/bulk-create-notebooks.sh`, `scripts/generate_episodes.sh`, `scripts/mcp-wrapper.sh`, `scripts/phi-loop-stack.sh`, `scripts/run_v51_multiple.sh`, `scripts/test-agent-bridge.sh`, `scripts/verify-notebooklm.sh`, `scripts/verify-ssot-integration.sh` | C | Keep | One-shot setup / human-invoked utilities; not gated. |
 
 ## New `tri` subcommands added by this PR