From b4df271d1b5f6e0ebc4f69aa620910b3a7f91e13 Mon Sep 17 00:00:00 2001
From: randypanding <randypanding@users.noreply.github.com>
Date: Wed, 19 Aug 2026 05:13:49 +0000
Subject: [PATCH 1/2] =?UTF-8?q?fix:=20gate=20JSON=20=E6=A0=A1=E9=AA=8C?=
 =?UTF-8?q?=E5=8E=BB=20apt=20=E5=8C=96=E2=80=94=E2=80=94apt-get=20update?=
 =?UTF-8?q?=20=E6=8C=82=E8=B5=B7=E7=83=A7=E7=A9=BF=20timeout=20=E4=BD=BF?=
 =?UTF-8?q?=20main=20gate=20cancelled?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/gate.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml
index 3b04162..fd1a6f1 100644
--- a/.github/workflows/gate.yml
+++ b/.github/workflows/gate.yml
@@ -36,10 +36,19 @@ jobs:
           EOF
       # JSON 全量校验（红队 #17-B）：expected-state.json 与 rulesets 同为 drift-check/apply 的
       # 期望状态真源——此前 gate 只验 rulesets/*.json，expected-state.json 畸形可静默合入
+      # python3 校验替代 apt 装 jq：2026-08-19 两次 main gate 因 apt-get update 挂起烧穿
+      # timeout-minutes: 10 整体 cancelled（run 32217218076/32217301896）；python 已就绪、
+      # 零外部依赖，消除该故障面。adr-required 用的 jq 系 runner 镜像预装（CI-Workflows
+      # ci.yml 从不安装 jq 且连跑绿，实证预装），无需 apt。
       - name: JSON 校验（rulesets + expected-state）
         run: |
-          sudo apt-get -qq update && sudo apt-get -qq install -y jq >/dev/null
-          for f in governance/rulesets/*.json governance/expected-state.json; do jq -e . "$f" >/dev/null || exit 1; echo "OK $f"; done
+          python3 - <<'EOF'
+          import glob, json
+          files = sorted(glob.glob("governance/rulesets/*.json")) + ["governance/expected-state.json"]
+          assert len(files) > 1, "未找到 JSON 文件"
+          for f in files:
+              json.load(open(f, encoding="utf-8")); print("OK", f)
+          EOF
       - name: 脚本语法检查
         run: |
           bash -n governance/apply.sh && bash -n governance/drift-check.sh && bash -n scripts/new-repo-init.sh && bash -n scripts/gh-app-token.sh

From 3e54c0b7b853ebfa99c18efbee2bf1e0e29f3cd6 Mon Sep 17 00:00:00 2001
From: randypanding <randypanding@users.noreply.github.com>
Date: Wed, 19 Aug 2026 05:20:02 +0000
Subject: [PATCH 2/2] =?UTF-8?q?fix:=20JSON=20=E6=A0=A1=E9=AA=8C=E9=A1=B6?=
 =?UTF-8?q?=E5=B1=82=E6=96=AD=E8=A8=80=20dict=E2=80=94=E2=80=94=E5=AF=B9?=
 =?UTF-8?q?=E9=BD=90=E5=B9=B6=E4=B8=A5=E4=BA=8E=20jq=20-e=20=E8=AF=AD?=
 =?UTF-8?q?=E4=B9=89=EF=BC=88qodo=20review=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/gate.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml
index fd1a6f1..eae4f80 100644
--- a/.github/workflows/gate.yml
+++ b/.github/workflows/gate.yml
@@ -47,7 +47,12 @@ jobs:
           files = sorted(glob.glob("governance/rulesets/*.json")) + ["governance/expected-state.json"]
           assert len(files) > 1, "未找到 JSON 文件"
           for f in files:
-              json.load(open(f, encoding="utf-8")); print("OK", f)
+              # 顶层必须是 JSON 对象（ruleset/期望状态均为对象结构）——语义对齐并严于
+              # 原 jq -e .（jq 仅拒 null/false，本断言连数字/字符串标量一并拒绝；
+              # qodo review：json.load 裸放行 null/false 属语义回归）
+              data = json.load(open(f, encoding="utf-8"))
+              assert isinstance(data, dict), f"{f}: 顶层须为 JSON 对象，得到 {type(data).__name__}"
+              print("OK", f)
           EOF
       - name: 脚本语法检查
         run: |