From 6d2645c0e39cbc1c4d6191caae5fbc8a28bfe7ec Mon Sep 17 00:00:00 2001
From: Binay <150876063+bkd-dotcom@users.noreply.github.com>
Date: Tue, 1 Sep 2026 04:02:36 -0400
Subject: [PATCH] ci: a failed weekly self-scan has to be visible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#106 fixed why the weekly governed self-scan was failing. This fixes why nobody
knew — which is the more interesting half.

The scan failed on 2026-08-17, 2026-08-24 and 2026-08-31, three consecutive
Mondays, and was only discovered because a human went looking at the run list. A
scheduled job that fails silently is indistinguishable from one that never ran,
and treating an absent signal as a passing one is exactly the mistake this engine
exists to catch. It should not have been our own weekly job doing it.

A failing scheduled run now files a report:

  - Only for `schedule`. A failed workflow_dispatch is already in front of the
    person who clicked it; filing an issue at them would be noise, and noise is
    how the first three failures got ignored.
  - One issue, reused. A fresh issue every Monday would bury the signal it exists
    to raise, so an already-open report gets a comment instead.
  - The label is created first, because `gh issue create --label` fails outright
    on a label that does not exist.
  - `issues: write` is scoped to this job alone. It gets nothing else — notably
    not the contents/pull-requests write the scan job holds.

The report states plainly that no fix PRs were opened and nothing was merged, so
reading it cannot leave anyone unsure whether a half-finished change landed.
---
 .github/workflows/signetry-autofix.yml | 50 ++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/.github/workflows/signetry-autofix.yml b/.github/workflows/signetry-autofix.yml
index 1bb31d4..6d372aa 100644
--- a/.github/workflows/signetry-autofix.yml
+++ b/.github/workflows/signetry-autofix.yml
@@ -260,3 +260,53 @@ jobs:
           # step runs, so an earlier failure made this resolve to "/scan-and-fixes.json".
           path: ${{ runner.temp }}/signetry/scan-and-fixes.json
           if-no-files-found: ignore
+
+  # A scheduled job that fails silently is indistinguishable from one that never ran.
+  # This one failed three Mondays running and nobody noticed until a human went looking
+  # — which is the same mistake the engine exists to catch: an absent signal being read
+  # as a passing one. So a red weekly run now has to be seen.
+  #
+  # Only for `schedule`. A failed workflow_dispatch is already in front of the person
+  # who clicked it; filing an issue at them would be noise, and noise is precisely how
+  # the first three failures got ignored.
+  notify:
+    needs: autofix
+    if: failure() && github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write        # job-level: this job files the report and needs nothing else
+    steps:
+      - name: Report the failed self-scan on an issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          LABEL="autofix-failure"
+
+          # `gh issue create --label` fails outright on a label that does not exist, so
+          # ensure it. Already-exists is the normal case and is not an error.
+          gh label create "$LABEL" \
+            --description "The weekly governed self-scan failed" \
+            --color B60205 >/dev/null 2>&1 || true
+
+          BODY="$(printf '%s\n' \
+            "The weekly governed self-scan failed." \
+            "" \
+            "- commit: \`$GITHUB_SHA\`" \
+            "- run: $RUN_URL" \
+            "" \
+            "No fix PRs were opened by this run. Nothing was merged — the pipeline never merges." \
+            "Close this issue once a run goes green; the next failure will reopen the report.")"
+
+          # One issue, reused. A fresh issue every Monday would bury the signal it exists
+          # to raise, so an already-open report gets a comment instead.
+          EXISTING="$(gh issue list --label "$LABEL" --state open --limit 1 \
+                        --json number --jq '.[0].number // empty')"
+          if [ -n "$EXISTING" ]; then
+            gh issue comment "$EXISTING" --body "$BODY"
+            echo "commented on existing report #$EXISTING"
+          else
+            gh issue create --title "Weekly self-scan is failing" \
+              --label "$LABEL" --body "$BODY"
+          fi