feat(2284): give the Bugbot gate a caller here (advisory)

[LukasWodka]

What this is

One of 19 sibling PRs rolling bugbot-gate.yml out to the rest of the org — the fleet half of tracebloc/backend#2284, following the claude-skills pilot (claude-skills#36).

This is step 2 of the three-step arming order the reusable's own header sets out: (1) the reusable reaches .github's main — done in #305/#312; (2) callers, advisory; (3) the bugbot / review required context — not taken here.

This is advice, not a gate — and that is deliberate

No branch protection is touched by this PR, and bugbot / review is not added to any required-context list. One measurement is why step 3 is not taken:

Bugbot does not review Dependabot PRs. Sampled 2026-08-25 over the last 30 PRs each of .github, cli, release-train, tracebloc-website, averaging-service and backend: every non-draft PR with no Cursor Bugbot check run on its head was authored by dependabot (cli#574, cli#575, tracebloc-website#510). The only other misses were drafts, which this gate passes by design.

Bugbot re-runs only on a push or an explicit bugbot run comment, so a requiredbugbot / review would park every Dependabot PR at a red check with no route to green. Until that is answered the verdict is reported and nothing is required.

Why it is safe to arm here

• Bugbot demonstrably runs in this repo. Derived rather than assumed: the cursor GitHub App is installed on the org with repository_selection: all, and a per-repo sample of the last 15 PRs found a terminal Cursor Bugbot check on every non-draft, non-Dependabot head. A repo where Bugbot never runs would only ever measure the gate's own 900s timeout.
• The pilot ran first.claude-skills#36 put the gate on real PRs on one low-traffic private repo before this went fleet-wide — CLAUDE.md rule 4 (arm while green), in the order that lets a misbehaviour be attributed to one repo rather than twenty.

repo-inventory.yml is not touched here — the flip is the required follow-up

Caller first, inventory entry after..github's caller state is read from its audit branch over the API, so a caller and its required row cannot land in one PR: the row would be checked against a branch the caller is not on yet. Same two-step blocked-gate and backend#2396 were forced into.

Between the two, a caller against an exempt row is the stale-exemption finding and the org audit is red. That window is the accepted cost of this order — the alternative is a PR that can never go green — and flipping every row to required is the required follow-up, one PR against tracebloc/.github covering all 20 repos.

Verification

• actionlint1.7.12 — the version pinned as a required check in tracebloc/.github — clean on this file.
• python3 -c "import yaml; yaml.safe_load(...)" clean.
• The uses: target resolves: bugbot-gate.yml is blob 936771bb on .github's main and develop alike, and really declares all four inputs this caller declines to pass.
• Below the header, this file is byte-identical to the proven pilot caller.
• No paths: filter · ready_for_review present · no secrets: inherit · no workflow_dispatch · no inputs passed (all four defaulted, min-severity: high included — restating the callee's default in 20 files is CLAUDE.md rule 1 in reverse).

What to watch on this PR

This PR is its own first observation: the caller is on the head, so the gate runs against it. Expected — bugbot / review reports, having read Cursor Bugbot's terminal verdict on the head, and passes with no findings open at or above high.

Refs tracebloc/backend#2284

---

Note

Low Risk
Adds an advisory CI workflow only; no application code, secrets inheritance, or branch protection changes.

Overview
Adds .github/workflows/bugbot-gate-caller.yml, a thin caller that runs the org reusable tracebloc/.githubbugbot-gate.yml on pull_request (opened, reopened, synchronize, ready_for_review). This is fleet rollout step 2 of backend#2284 (after the claude-skills pilot): Bugbot findings surface as the bugbot / review check without making it a required status context.

The workflow uses concurrency with cancel-in-progress, read-onlycontents, checks, and pull-requests permissions, and nopaths filter, secrets: inherit, workflow_dispatch, or explicit inputs (callee defaults, including min-severity: high). repo-inventory.yml and branch protection are unchanged; flipping inventory rows to required is documented as a separate follow-up.

^{Reviewed by Cursor Bugbot for commit b043280. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saqlainsyed007]

LGTM. Verified this is the same thin-caller shape I reviewed on backend#2519, confirmed against the live callee at tracebloc/.github@main: jobs.bugbot.uses points at bugbot-gate.yml@main (a workflow_call reusable whose job id is review, so the context resolves to bugbot / review), no with:/secrets: (all four inputs default, runs on github.token), contents/checks/pull-requests: read matches the callee's needs, ready_for_review handled, per-PR concurrency, no paths: filter, and no branch-protection change — advisory, per step 2 of #2284. CI green, no threads.