ci: expose SHA-pinned on-demand Dakota lab validation

[mrbobbytables]

Summary

Exposes an on-demand, SHA-bound validation contract for projectbluefin/dakota pull requests under validation class dakota-bst-qa. This provides review automation (review) and operators with a reliable, bounded mechanism to request lab validation without cluster credentials.

Scope & Implementation

• GitHub-authenticated dispatch: Added .github/workflows/dakota-validation-dispatch.yml supporting repository_dispatch (types: dakota-validation, dakota-bst-qa) and workflow_dispatch running on ghost-runners.
• Preflight validation: Implemented scripts/dakota_validation.py to validate requests and query live PR head state before cluster submission. Rejects unsupported repo/class, closed PRs, malformed SHAs, and head mismatches.
• Deduplication & terminal rerun: Identical active requests (queued or running) are deduped; explicit terminal rerun (--rerun) is permitted for completed runs.
• SHA isolation: Requests and evidence are strictly bound to the requested exact commit SHA (evidence from SHA A never applies to SHA B).
• Execution: Added argo/workflow-templates/dakota-bst-qa.yaml to run the existing Dakota BuildStream build and container QA pipelines.
• Reporting: Reports across the 8 canonical lifecycle states (unavailable, rejected, queued, running, success, failure, cancelled, timeout) and publishes testing-lab/dakota-bst-qa commit status evidence back to GitHub.
• CLI & Justfile: Added dakota-validate-request and dakota-validate-status recipes to Justfile.
• Documentation: Updated docs/reference/WORKFLOWS.md and docs/skills/dakota-pr-review/SKILL.md.

Closes #638

— hive: backend=copilot model=gemini-3.8-flash

🐝 Hive Agent: contributor | SHA: 7c072e4ec

[hanthor]

The dispatch workflow cannot authenticate against projectbluefin/dakota

.github/workflows/dakota-validation-dispatch.yml passes the default installation token:

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  REPO: ${{ github.event.client_payload.repository || ... || 'projectbluefin/dakota' }}

secrets.GITHUB_TOKEN in a projectbluefin/lab workflow run is scoped to projectbluefin/lab only. But scripts/dakota_validation.py writes commit statuses to the target repo:

status_url = f"{api_base}/repos/{repository}/statuses/{sha}"   # line 318
...
"Authorization": f"Bearer {token}",                            # line 328

with repository = projectbluefin/dakota. Every dispatch will therefore 403 on the status POST. request also reads --token from GITHUB_TOKEN/GH_TOKEN (lines 677, 694), so the same token is used for the pulls/{n} head-SHA verification at line 432 — that one at least works for a public repo, but the status publish does not.

Confirming there is no cross-repo credential in this repo today:

$ grep -rn "secrets\." .github/workflows/ | sort -u
.github/workflows/derive.yml:67:          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
.github/workflows/update-test-results.yml:119:          DEPLOY_KEY: ${{ secrets.DASHBOARD_DEPLOY_KEY }}
.github/workflows/update-test-results.yml:52:          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
.github/workflows/update-test-results.yml:77:          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

So this needs either a new org-scoped PAT / App-token secret wired into the workflow, or a GitHub App token minted in-job. As written, permissions: statuses: write grants write on lab, not on dakota — which is misleading, because the workflow will look correctly permissioned and still fail at runtime.

Please also say in the PR body which secret this is meant to use, since the reviewer cannot see org secrets.

What does check out

Nothing else blocking that I could verify mechanically:

• python3 -m pytest tests/unit/ on this branch merged into main: 562 passed, 1 skipped (baseline on main is 539 passed, 1 skipped), so the 559 lines of new tests/unit/test_dakota_validation.py all pass and nothing regressed.
• The branch merges into main cleanly.

Smaller notes

1. ${RERUN_FLAG} is expanded unquoted under set -euo pipefail. It works (empty string word-splits to nothing), but --rerun would read more clearly as an array: RERUN_FLAG=(); [[ "${RERUN}" == "true" ]] && RERUN_FLAG=(--rerun) then "${RERUN_FLAG[@]}".
2. github.event.inputs is the deprecated spelling; inputs.* is the current one for workflow_dispatch. Not urgent, but actionlint may start flagging it.
3. This is 1592 added lines across 8 files with zero PR CI running on it — lint.yaml and ci.yml do trigger on pull_request, but every run on a fork/bot head in this repo completes with conclusion: action_required (approval gate), so no check has actually executed. Worth calling out that just lint / actionlint output was run locally before merge, since nobody else can see it.

---

Generated by Claude Code