@@ -465,6 +465,32 @@ jobs:
465465 - name : Shard attestation gate
466466 run : pnpm check:shard-attestation
467467
468+ # Required-context name pin (#6865). A GitHub required status check is
469+ # matched BY CHECK-RUN NAME, and a job's check-run name is its `name:`
470+ # value — so eight job `name:` literals across this file and ci.yml are
471+ # branch-protection contract, and until now nothing asserted them.
472+ # Renaming one is a one-line edit whose consequence is silent and
473+ # repo-wide: the old context never reports again (permanent pending, which
474+ # wedges the PR and the queue), or it gets dropped from the settings to
475+ # unwedge things and every gate that job carries degrades to advisory.
476+ # That second shape is #5617 — PR #5584 merged with THIS job red for 19
477+ # minutes, and four more merges repeated it the same night. ci.yml states
478+ # the contract in prose in eight places and check:shard-attestation
479+ # asserts the two aggregate gates' job IDS; neither pins a name literal,
480+ # and this file had neither. The pin also holds each enrolled job to the
481+ # shapes that let a bare name report at all (no matrix, no
482+ # continue-on-error) and each enrolled workflow to the triggers a required
483+ # context needs (`merge_group`, and a `pull_request` with no `paths:`) —
484+ # the machine-readable form of #5617's audit exclusions. It deliberately
485+ # does NOT judge job-level `if:`: four of the enrolled ci.yml jobs carry a
486+ # filter-driven `if:` by design (#4928), and a skipped job still publishes
487+ # a context. ⚠️ It cannot verify the required SET itself — Settings →
488+ # Rulesets is unreadable from every agent seat (403) — so it asserts the
489+ # repo-side half only, and the script's header says so at length.
490+ # Reads two YAML files; sub-second.
491+ - name : Required-context name pin
492+ run : pnpm check:required-contexts
493+
468494 # #4248 packaging-hygiene guard. Without a `files` whitelist npm packs the
469495 # whole package directory, and 20 of the 49 publishable packages declared
470496 # none — so consumers installed TypeScript sources, unit tests and build
0 commit comments