From f3879556722047258bce4ee4c5c5dc22257e59e7 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 5 Aug 2026 14:26:25 +0100 Subject: [PATCH] =?UTF-8?q?refactor(ci):=20relabel=20the=20blocking=20chec?= =?UTF-8?q?ks=20=F0=9F=94=B4=20=E2=80=94=20they=20were=20badged=20?= =?UTF-8?q?=F0=9F=9F=A1=20while=20required?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gate-tier invariant lint found checks carrying the 🟡 CHECK: prefix that are, in fact, required status checks. The label was lying in the reassuring direction, which is the dangerous one: the taxonomy defines 🟡 as "red is a question, not a stop", so a contributor reads the badge, treats a failure as advisory, and then cannot merge. Relabelled to match reality: 🟡 Check: Governance metadata -> 🔴 Gate: ... 🟡 Check: OpenSSF best-practices -> 🔴 Gate: ... 🟡 Check: Hypatia baseline security scan -> 🔴 Gate: ... (only the ones this repository actually requires; the invariant is per-repo, so the same workflow can legitimately be 🟡 elsewhere.) ENFORCEMENT IS UNCHANGED. This edits the workflow `name:` only. A required status check matches on the CONTEXT, which is the JOB name — so relabelling cannot strand a rule or create a phantom. Nothing starts or stops blocking because of this commit; the board simply stops misdescribing what already blocks. Worth stating why this needed a lint to find. Nobody audits a yellow badge — it reads as "informational" and the eye moves on. The mismatch is only visible by comparing the workflow list against the ruleset, which is exactly the kind of cross-check that decays the moment it is left to attention rather than machinery. Found by scripts/check-gate-tiers.sh (hyperpolymath/standards#578, #581). Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/governance.yml | 2 +- .github/workflows/openssf-compliance.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 421f6d8..f634d9c 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,6 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -name: "🟡 Check: Governance metadata" +name: "🔴 Gate: Governance metadata" on: push: diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index fe45d17..ca08a5f 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -2,7 +2,7 @@ # This workflow is managed by gh actions-lock. # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack # required files or still contain unfilled placeholder tokens. -name: "🟡 Check: OpenSSF best-practices" +name: "🔴 Gate: OpenSSF best-practices" on: push: branches: [main]