test(ci): derive the merge_group subscription floor from REQUIRED_CONTEXTS

[yinlianghui-tw]

Fixes#6160

MUST_SUBSCRIBE_MERGE_GROUP in scripts/__tests__/merge-queue-reporting.test.ts was a
hand-maintained membership list, and it had already fallen behind twice. The card measured six
named workflows against eight producing an unfiltered blocking check; on main today it is seven
against ten — doc-component-types.yml, doc-snippet-types.yml and doc-fence-languages.yml all
produce a REQUIRED_CONTEXTS check and none of them was inside the floor. Nothing was broken on
disk: all three really do subscribe merge_group. What was missing was the assertion that they keep
doing so.

Per the ruling on the card this takes option 2: the floor now derives from REQUIRED_CONTEXTS
in scripts/dependabot-merge-gate.mjs. That is not mechanising an unmechanisable judgement — the
map's old header was right that "may this context be required?" is a property of repository
settings, and REQUIRED_CONTEXTS is already a human's written-down answer to exactly that question,
elsewhere in this repo. Deriving from it stops one judgement being written down twice. The
hand-maintained map keeps carrying the reasons; it stops carrying the membership.

The precondition, measured in both directions before any assertion was written

A derived floor is an improvement only while it is a superset of what the map named — one that
silently narrowed would read as more coverage while asserting less, which is this card's own defect
one level up.

direction	reading on b37d3f0fd
every workflow in MUST_SUBSCRIBE_MERGE_GROUP also produces a REQUIRED_CONTEXTS check (the derivation loses nothing)	7 / 7 — no violations
every workflow producing a REQUIRED_CONTEXTS check is on main and subscribes merge_group (the derived floor is satisfiable today)	10 / 10 — no violations, no workflow YAML needed changing

Both readings are clean, so the derivation strictly widens: 7 workflows → 10.

The containment is not left as a measurement taken once. loses nothing the hand-maintained map named pins it as an assertion, so the two declarations cannot cross later without going red: a map
entry naming a workflow that produces no required context fails, and the fix is to add the check to
REQUIRED_CONTEXTS or drop the entry — never to re-grow a hand-maintained membership.

What changed

• scripts/__tests__/workflow-checks.ts (new) — the check-name → workflow-file parser, moved
  verbatim out of dependabot-merge-gate.test.ts so there is one parser rather than two. It is
  a module rather than an export of the test file because importing a *.test.ts from another
  *.test.ts re-registers its describe blocks inside the importer, running the same suite twice
  under the wrong filename.
• scripts/__tests__/dependabot-merge-gate.test.ts — imports those helpers instead of defining
  them. No assertion changed.
• scripts/__tests__/merge-queue-reporting.test.ts — the derived floor and three assertions
  (below), plus a re-headed map explaining what it still carries.
• content/docs/guide/ci-cd-pipeline.md — the page stated "nothing derives the set" and told
  authors to add an entry to the map. This change makes both sentences false, so they are corrected
  in place: name the context in REQUIRED_CONTEXTS and the workflow is inside the floor from that
  moment. No workflow names and no cardinality were added, so the ci-cd-pipeline.md's "Five workflows subscribe" merge_group list is short by one (skills-paths.yml, since #3735) — the #3261 shape, one subsystem over #4154 pins still hold.
• Declared, beyond the literal card scope: the ci-cd-pipeline.md's "Five workflows subscribe" merge_group list is short by one (skills-paths.yml, since #3735) — the #3261 shape, one subsystem over #4154 doc-enumeration scan now runs over the
  union of the map and the derived floor. Same defect class, same file, same gate family — scanning
  only the map would have let the page freely enumerate the three subscribers the map had fallen
  behind by, i.e. the drift would hide in precisely the gap this PR exists to close. Evidence it is
  a widening and not a fix in disguise: doc-component-types.yml, doc-snippet-types.yml,
  doc-fence-languages.yml and pre-install-import-graph.yml each appear 0 times in the
  ## Merge Queue section, so the widened scan is green on today's prose.

⛔ No workflow YAML was edited.

The context the floor protects (cited in the test header)

A required context that does not report on a queue build does not fail the queue — it stalls
it until the ruleset's 60-minute status-check timeout. That is #3523: while nothing subscribed, the
queue's required set could only be empty, so it rebuilt each PR on the current main and merged it
unvalidated. On 2026-08-07 three pull requests (#3503, #3510, #3516) merged with Type Check at
conclusion=failure, onto a main left with a type error by #3498; a hot fix followed in #3505.

Non-vacuity — three ablations, direction predicted before running

No build leg exists for any of them: these assertions read .github/workflows/* from disk and
import ../dependabot-merge-gate.mjs by relative source path — no package exports resolution
and no vitest alias, so nothing resolves through a dist/. Each mutation was proven on disk by
grepping the anchor text before and after (never the editor's exit code), each script carried a
trap '<restore>' EXIT INT TERM, restoration used git checkout HEAD -- <path> and was proven with
an empty git diff HEAD.

1 — positive control (not optional): delete merge_group: from doc-component-types.yml.
Predicted: the NEW assertion reds; the EXISTING map assertion stays green, because that file is not
in the map — the gap is the card. Observed exactly that. merge_group lines 1 → 0;
Tests 1 failed | 17 passed:

× the merge_group floor derives itself from REQUIRED_CONTEXTS (#6160) > requires merge_group of every workflow that produces a required context
- doc-component-types.yml (produces Doc Component Type Check)
✓ every requirable context reports on a merge-queue build (#3523 step 1) > subscribes merge_group in each workflow that produces one

2 — delete it from docs-links.yml. Predicted: the EXISTING assertion must still red, proving
working coverage was not replaced by weaker coverage; the new one reds too, since that file produces
Internal Docs Link Check. Observed both: Tests 2 failed | 16 passed (18).

3 — add a synthetic REQUIRED_CONTEXTS entry naming a workflow that does not subscribe.
'Hook Self-Tests' (hook-selftests.yml: pull_request, no merge_group). Predicted: the derived
floor reds naming that workflow, i.e. it tracks the other declaration rather than a snapshot of it —
and dependabot-merge-gate.test.ts reds separately on the duplicate classification, expected noise
from a synthetic entry. Observed: Tests 3 failed | 50 passed (53), the floor naming
hook-selftests.yml (produces Hook Self-Tests).

Verification — all on 2cdacf420 (the final commit), exit codes captured by redirect before any pipe

Root vitest only (objectui#3378).

gate	verdict line
vitest run on the three affected test files	Test Files 3 passed (3) / Tests 85 passed (85)
pnpm type-check:scripts	exit 0
pnpm lint:root	✖ 28 problems (0 errors, 28 warnings) — 186 files linted, all 28 warnings pre-existing and in untouched files
pnpm check:control-bytes	✅ check-control-bytes: OK (scanned 5110 tracked text file(s); skipped 85 binary).
pnpm docs:check-links	Links are valid across 15 scan roots.
pnpm check:doc-types	✅ Every documented component type is registered.
pnpm check:doc-fences	✅ check:doc-fences — every TypeScript block in 223 document(s) is fenced ts/tsx/typescript…
pnpm check:doc-snippets (after pnpm build, 43 successful)	Every covered documentation snippet compiles against the built types. — 251 of 251 block(s) judged, 0 failed
node scripts/check-changeset-presence.mjs	✅ No source of a released package changed in this range, so no changeset is owed.

Declared narrowing.pnpm lint (turbo run lint) and the full pnpm test farm were not run
locally; CI runs both. The lint narrowing is measured rather than assumed: the population comes from
eslint's own config resolution (186 files, --format json count), it includes all three .ts files
this PR touches, and eslint.config.js configures no type-aware linting (no project /
projectService), so this diff cannot move the verdict on any file it did not touch.

pnpm exec vitest run scripts/ was also run in full: Tests 1934 passed, with two 15-second
timeouts in check-changeset-presence.test.ts and check-i18n-en-drift.test.ts — both build real
git fixture repos, both pass in isolation (Tests 75 passed (75), exit 0), and neither file is
touched by this diff or reads anything it changes. Load flakes, per AGENTS.md §测试纪律.

Generated by Claude Code

---

Generated by Claude Code