fix(ci): keep required status gate trusted

[devantler]

🤖 Generated by the Agentic Engineer

Motivation

CI - Required Checks is the repository-wide status gate. It checked out the candidate merge ref and then executed ./aggregate-job-checks, so a pull request could alter the local action that decided whether the required check passed. The gate also carried a read-scoped token it did not need.

What changed

• Aggregate the declared needs.*.result values in the workflow step itself; the gate no longer checks out or executes workspace code.
• Set the gate's permissions to {}.
• Preserve fail-closed handling for failed, cancelled, and unknown results, and reject an empty result list explicitly.
• Keep needs and the inline JOB_RESULTS list under the existing two-way parity guard.
• Add a behavioral regression test that executes the real inline script and pins the permission and workspace-independence boundaries.
• Update AGENTS.md so the repository contract describes the current wiring.

Verification

• RED on current main: the new boundary test rejected contents: read and the checked-out local action.
• RED on the earlier draft: an empty result list failed without the required actionable diagnostic.
• GREEN: success/skipped passes; failure, cancellation, unknown state, and empty input all fail closed with the expected diagnostic.
• The real CI wiring-parity script and ShellCheck pass.
• Zizmor 1.29.0 reports no findings in offline regular-persona mode.
• Actionlint reports only the repository's documented unsupported code-quality permission-scope diagnostics.

Trust-boundary limit

This removes the additional candidate-workspace execution boundary after checkout. It does not claim that a pull-request workflow definition is immutable; the repository's main-pinned required workflows remain the separate ruleset-level protection.

[github-code-quality]

Code Coverage Overview

Languages: Go, C#

Go / code-coverage/test

The overall coverage remains at 50%, unchanged from the main branch.

C# / code-coverage/dotnet

The overall coverage remains at 100%, unchanged from the main branch.

---

_{Updated July 20, 2026 09:45 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	0.45s
✅ GO	revive	2		0	0	10.04s
✅ REPOSITORY	betterleaks	yes		no	no	0.51s
✅ REPOSITORY	checkov	yes		no	no	19.99s
✅ REPOSITORY	gitleaks	yes		no	no	0.09s
✅ REPOSITORY	git_diff	yes		no	no	0.03s
✅ REPOSITORY	osv-scanner	yes		no	no	0.53s
✅ REPOSITORY	secretlint	yes		no	no	0.87s
✅ REPOSITORY	syft	yes		no	no	1.57s
✅ REPOSITORY	trivy	yes		no	no	12.98s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.21s
✅ REPOSITORY	trufflehog	yes		no	no	6.14s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters COPYPASTE_JSCPD,GO_REVIVE,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler, I will review the pull request.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

@devantler, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 65ef4b78-8acc-4061-a324-a9a5fd748a2c

📥 Commits

Reviewing files that changed from the base of the PR and between 5299370 and 5881220.

📒 Files selected for processing (3)

• .github/tests/ci-merge-group-isolation-bad-fixture.yaml
• .github/tests/test-ci-merge-group-isolation.sh
• .github/workflows/ci.yaml

📝 Walkthrough

Walkthrough

The ci-required-checks gate now uses an inline Bash summary step with JOB_RESULTS. It requires no token permissions, checkout, or workspace-dependent actions. The workflow validates parity between gate dependencies and aggregated results. New boundary tests cover gate structure and result states. CI documentation and test-job guidance now describe the inline aggregation contract.

Possibly related PRs

• devantler-tech/actions#594: Modifies required-check aggregation and coverage in ci.yaml.
• devantler-tech/actions#612: Adds release-test jobs to required-check aggregation.
• devantler-tech/actions#704: Modifies and tests the required-check gate boundary, permissions, and merge-queue behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main CI trust-boundary fix for the required status gate.
Description check	✅ Passed	The description directly explains the required-check gate changes, trust boundary, tests, and verification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler, I will review the changes in #679.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devantler]

🤖 Generated by the Agentic Engineer

CodeRabbit did not deliver a current-head review: request 5226443306 was rate-limited at 2026-08-08T14:04:11Z.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 5881220950

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness evaluation

Reviewed head: 5881220950de5e73d06400c5ba23cf8f378445da

I exercised the real inline required-check script from .github/workflows/ci.yaml, not a duplicate implementation. As the gate's user, I observed success skipped pass, and observed failure, cancellation, an unknown result, and an empty result list all fail closed with actionable diagnostics. I also ran the merge-group isolation and CI wiring-parity guards against the final workflow.

The full current-head GitHub matrix and CI - Required Checks are green; the PR is CLEAN with zero unresolved threads or review-body findings. CodeRabbit was rate-limited on this head, and Codex then returned a clean current-head review for 5881220950.