fix: org-gate merge_group EXPECTED_SKIP（v1.4.2，.github#135，ADR-0046）

[randypanding]

缺陷: Cloudbird-Software/.github#135 | 依据: ADR-0046 决策 5（org-gate 变更走版本发布流程）

问题

merge_group 事件下 org-adr-required 被 if: github.event_name == 'pull_request' 设计性 skip（C1 的 ADR 校验在 PR 事件已跑，队列分支不重跑——合理），但 org-gate 严格聚合器断言全部 needs success（ADR-0032 skipped≠success）且自称"无事件条件 job，无 EXPECTED_SKIP"——不实。结果：merge queue 仓（agent-registry/template-service）每个 PR 都被队列弹回（证据：agent-registry run 32442341702；昨日 #65 是 owner 在弹回后走 admin 通道合并掩盖了问题）。

修复

聚合器在 merge_group 事件下把 org-adr-required 的 skipped 列入 EXPECTED_SKIP 白名单（唯一 key + 唯一事件，其余任何 skip 仍红）。github.event_name 经 env 间接引用（zizmor 惯例）。

发布（ADR-0046 决策 5）

本 PR 合并后：tag v1.4.2 → org ruleset org-required-workflows 钉点 ref 更新 → .github 仓 rulesets/org-required-workflows.json + expected-state.json 落盘同步（引用 ADR-0046 的 PR）。

Summary by CodeRabbit

• 修复
  • 优化合并队列中的检查结果判断：允许特定非必需检查被跳过。
  • 其他必要检查仍必须成功，确保合并前的验证要求不变。
  • 非合并队列事件继续要求所有上游检查成功。

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a8475c81-b459-4fd4-8671-7d29ef59b21e

📥 Commits

Reviewing files that changed from the base of the PR and between edcb58d and fad8c69.

📒 Files selected for processing (1)

• .github/workflows/org-gate.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

组织门禁事件聚合

Layer / File(s)	Summary
按事件校验上游任务结果 .github/workflows/org-gate.yml	merge_group 事件允许 org-adr-required 为 skipped。其他上游任务仍必须为 success。非 merge_group 事件要求所有上游任务成功。工作流同时更新注释、步骤名称和错误提示。

Suggested labels: security, bug

Merge Risk: ⚪ Minimal · up to fad8c

This narrowly updates merge-group gate handling so the intended ADR check skip is accepted without relaxing other skip behavior. No actionable merge-blocking risk remains; the PR is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 1 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	标题使用了有效的 fix: 前缀，但长度为 68 个字符，超过 50 个字符限制。	将标题压缩到 50 个字符以内，同时保留 fix: 前缀和对 merge_group skip 处理的核心描述。

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-org-gate-merge-group

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can tweak Display preferences with a live preview to see your comment before it ships

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

PR Summary by Qodo

Fix org-gate: allow org-adr-required skipped on merge_group only

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Treat org-adr-required as an expected skip on merge_group to unblock merge queue.
• Keep strict "skipped≠success" semantics for all other jobs and events.
• Indirectly reference github.event_name via env for workflow security/tooling conventions.

Diagram

graph TD
  E["GitHub event"] --> HY["org-hygiene"] --> OG["org-gate"] --> D{"merge_group?"} --> MQ["Merge queue"]
  E --> ADR["org-adr-required"] --> OG
  D -->|"yes: allow ADR skipped"| MQ
  D -->|"no: require all success"| MQ

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Run org-adr-required on merge_group too

• ➕ Removes the need for any expected-skip exception in the aggregator
• ➕ Keeps policy evaluation consistent across PR and merge queue contexts
• ➖ May be redundant/expensive since PR checks already validated ADR requirements
• ➖ Could introduce new merge queue-only failure modes or additional API usage limits

2. Treat all skipped as success in org-gate

• ➕ Simpler aggregator logic
• ➕ Avoids maintaining an explicit skip whitelist
• ➖ Violates ADR-0032 intent (skipped≠success) and weakens enforcement
• ➖ Risks masking unintended skips in other required jobs

Recommendation: Keep the current approach: a single-key, merge_group-only EXPECTED_SKIP whitelist. It fixes the merge queue regression while preserving the strict "skipped≠success" contract everywhere else, minimizing policy surface area and avoiding redundant ADR checks on queue branches.

Files changed (1) +13 / -5

Other (1) +13 / -5

org-gate.ymlWhitelist org-adr-required skipped on merge_group in strict org-gate check +13/-5

Whitelist org-adr-required skipped on merge_group in strict org-gate check

• Updates the org-gate aggregator assertion to allow org-adr-required to be "skipped" only when the triggering event is merge_group. For all other events, the aggregator continues to require every needed job to be "success" and fails closed with a clear error message.

.github/workflows/org-gate.yml