[narduk-lane-automation]

This PR has two parts: required-reuse is now on by default, and a dependency audit that would block can no longer be skipped by reuse.

Why

The goal is one shared CI where every speedup reaches every repo. required-reuse-pr-results lets a default-branch push reuse a green PR's full Required result. 43 of the 67 nuxt-cloudflare.yml callers never turned it on, and 36 of those had no R2 secrets, so it could not work for them. workflows#229 removed the need for the store. favicon-checker, which has no R2 secrets, proved it live: its main CI went from 266–877 s to 25 s (run 41142752580). With the default on, every caller gets reuse on its next pin bump.

Change

• Default on. required-reuse-pr-results now defaults to true. A push repeats the gate only when its tree, caller workflow or inputs differ from a green PR's full run. A PR that ran fast-only publishes no proof, so its push runs in full as before. Set the input to false for a gate whose behaviour intentionally differs between PR and push.
• Never beside the production handoff. With production-output-directory set, reuse never applies, in both reuse-plan and Required's REUSE_APPLIES, because the main push must build the artifact it hands off. That covers stonx's runner-upload.yml and the #4795 rollout. The handoff guard that demanded required-reuse-pr-results=false now checks only build-script.
• Dependency audit can't be skipped (a fix that already matters today).
  • The audit warns on a PR and blocks on the default branch, but the Required key has no event in it. So a PR whose audit found a fixable high or critical minted a proof, and its push reused it, skipping the one run that blocks.
  • The Opus verify swept 22 opted-in repos and found 6 of 67 reused pushes that did this, each then promoted:
    • borderwaitstat-us 41012462435;
    • clawdle 40960642515 and 40925403234;
    • ogpreview-app 41000262576 and 40971067927;
    • tx-spends 40959972778.
  • Now the PR audit writes would-block=true when it suppressed a block (findings, or no report). Build exports audit-would-block, and Compute Required proof key mints nothing for that run, so its push runs the full gate, audit included.
• E2E key. The E2E proof key no longer includes required-reuse-pr-results. The input never changes what E2E tested, and leaving it in would have re-keyed every caller's E2E proof.

Known side effects (not blockers, per the verify)

• Callers with checks-in-build lose the Required-into-Build fold, because the fold requires reuse off: favicon-checker and sanitize-data. That's one extra job per run until they set reuse false or the fold learns about reuse.
• pr-fast-only callers with no e2e-full-paths never mint a proof, so their pushes pay about 10–30 s of Reuse plan for nothing.
• riverstatus, already opted in, runs its full unit suite only nightly, because its test:changed is targeted on PRs.

Tests

• test_dependency_audit.py: would-block is set only on a PR's suppressed block (fixable high, no report), never on a clean or unfixable-only tree. A blocking event still fails the step.
• test_fast_path.py:
  • the default is on;
  • reuse is off beside the handoff;
  • the proof key refuses an audit-would-block run;
  • the opted-out graph is still origin/main's;
  • the E2E key ignores the reuse input.
• test_production_upload.py: the guard needs only build-script.

Review

One Opus verify (loosening a gate default) found two blockers, B1 (the audit) and B2 (the handoff guard). Both are fixed above with tests.

Gates

• scripts/precheck on 58f6c88: exit 0, 40/40 commands passed. Its timed lines:

  PASS 12.86s bash scripts/install-actionlint-native-alerts.sh actionlint
  PASS 0.97s actionlint -no-color -oneline .github/workflows/*.yml
  PASS 0.39s python3 scripts/lint_callables.py
  PASS 0.75s python3 scripts/test_actionlint_native_permissions.py
  PASS 20.10s python3 scripts/test_apple_gate.py
  PASS 1.25s python3 scripts/test_artifact_budget.py
  PASS 0.78s python3 scripts/test_cache_paths.py
  PASS 5.19s python3 scripts/test_ci_admission.py
  PASS 5.23s python3 scripts/test_ci_artifact_store.py
  PASS 7.67s python3 scripts/test_dependency_audit.py
  PASS 1.36s python3 scripts/test_design_ledger.py
  PASS 0.26s python3 scripts/test_design_publish.py
  PASS 3.32s python3 scripts/test_e2e_build_artifact.py
  PASS 6.53s python3 scripts/test_e2e_mode.py
  PASS 7.04s python3 scripts/test_e2e_pr_subset.py
  PASS 1.28s python3 scripts/test_e2e_quarantine.py
  PASS 23.20s python3 scripts/test_e2e_reuse.py
  PASS 21.82s python3 scripts/test_e2e_skip_paths.py
  PASS 2.22s python3 scripts/test_eslint_cache.py
  PASS 1.09s python3 scripts/test_exact_candidate.py
  PASS 0.72s python3 scripts/test_extra_env.py
  PASS 40.22s python3 scripts/test_fast_path.py
  PASS 0.70s python3 scripts/test_flake_digest.py
  PASS 4.35s python3 scripts/test_foundation_check.py
  PASS 5.53s python3 scripts/test_package_auth_cleanup.py
  PASS 0.78s python3 scripts/test_package_batch_metadata.py
  PASS 0.93s python3 scripts/test_permission_ceiling.py
  PASS 1.49s python3 scripts/test_playwright_toolchain.py
  PASS 13.61s python3 scripts/test_preview_gate.py
  PASS 2.57s python3 scripts/test_production_upload.py
  PASS 0.10s python3 scripts/test_python_static_gate.py
  PASS 1.07s python3 scripts/test_quality_gates.py
  PASS 2.12s python3 scripts/test_red_main_listener.py
  PASS 0.08s python3 scripts/test_required_gate.py
  PASS 0.72s python3 scripts/test_reusable_browser_tests.py
  PASS 8.24s python3 scripts/test_runner_default.py
  PASS 19.80s python3 scripts/test_script_gates.py
  PASS 1.41s python3 scripts/test_store_placement.py
  PASS 18.32s python3 scripts/test_taskgraph.py
  PASS 0.07s python3 scripts/test_tee_pipefail.py

🤖 Generated with Claude Code