fix(ci): carry the trusted-bot bypass to check, which never had it - #3336
Merged
Conversation
…efs #3335) The census moved because this adds one `run:` step: quiet 127 -> 128 and shell 234 -> 235. Confirmed mine, not a neighbour's, by running the gate on a clean origin/master checkout with the same binary first -- it passes there.
gHashTag
enabled auto-merge (squash)
September 5, 2026 19:41
Contributor
|
📓 NotebookLM Notebook linked to this PR
This notebook contains session context, decisions, and artifacts for this work. |
Contributor
This was referenced Sep 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3335
Verified independently before acting.
check-now-freshness.yml(the required contextcheck) has IS_BOT: 0, conditional steps: 0. Its neighbours have 6/5 and 3/2.#1081 gave those two the bypass on 2026-06-14 for a stated reason: a skipped required check never satisfies branch protection, so it must be a step that passes, not a job that is skipped. This job was exempt only because its whole body was
echo "Checking repository freshness..."— its blindness WAS the bypass, and #2756 gave it real work on 2026-08-28.Measured today. Eight open Dependabot PRs:
checkThe five green ones are green only because their last run predates the change; any synchronize or title edit re-runs the job and flips them. Ruleset not editable, no bypass_actors → red
checkmeans never merges.The failure text asserts what is false on exactly this population: "NOW Sync Gate should have caught that first" — on a bot PR, NOW Sync Gate deliberately does not look.
The expression is now identical in all three files, compared character for character rather than assumed.
The census moved because this adds one
run:step (quiet 127 → 128, shell 234 → 235). Confirmed mine and not a neighbour's by running the gate on a cleanorigin/mastercheckout with the same binary first, where it passes.Found by an adversarial pass over the four required contexts: 8 candidates, 6 survived refutation, 2 refuted. The other five are recorded for the next pass.