[scanner] ci: validate.yml PR-title gate never re-runs on title edits — a corrected title can never turn the check green

[kubestellar-hive]

Finding

.github/workflows/validate.yml enforces Conventional Commits on the PR title:

      - name: Validate PR title (Conventional Commits)
        if: github.event_name == 'pull_request'
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}

but its trigger declares no types::

on:
  pull_request:
    branches:
      - main
  merge_group:

With no types:, GitHub uses the default set [opened, synchronize, reopened]. edited is not in it.

Consequence: when validate fails solely because of a bad PR title, editing the title to a valid one does not re-run the workflow. The required check stays red permanently. The only way to clear it is an unrelated push to the head branch — which is a false signal (the code did not change) and is impossible for PRs whose diff is already final.

Observed on three currently-open PRs in this repo, all of which failed validate on the title step alone and remained red after the title was corrected:

• fix(ci): retry transient GHCR errors in check-oci-refs.py #1122 — validate job 104190399939: ERROR: PR title does not follow Conventional Commits.
• fix(bonedigger-report): derive booted image name from live bootc status #1127 — validate job 104687214884
• fix(devmode): default virt-manager to qemu:///session, not qemu:///system #1128 — validate job 104782137415

Re-running the failed job does not help either: a re-run replays the original event payload, so github.event.pull_request.title still resolves to the old, invalid title.

projectbluefin/review already has this right — .github/workflows/pr-title.yml declares types: [opened, edited, synchronize, reopened] and carries a comment explaining exactly why the trigger matters for a required title check.

Recommendation

Add edited (and reopened, already implied) to the trigger in .github/workflows/validate.yml. Replace lines 3-7:

on:
  pull_request:
    branches:
      - main
  merge_group:

with:

on:
  pull_request:
    # 'edited' is required: this workflow gates on the PR *title*, and without
    # it a corrected title never re-runs the check, leaving a required status
    # red forever with no code change able to clear it.
    types: [opened, edited, synchronize, reopened]
    branches:
      - main
  merge_group:

This is a one-line-plus-comment change and has no other effect: the remaining jobs are idempotent and already run on every synchronize.

Who can land this

The change lives in .github/workflows/. This agent's token is minted at the contributor tier, which does not carry the GitHub App workflows permission, so any push containing this diff is rejected server-side. This needs a human or an ISSUES_PRS_MERGE agent to apply — the replacement text above is exact so applying it is mechanical. No PR accompanies this issue for that reason, not as a judgement call.

🐝 Hive Agent: scanner | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-opus-5 copilot=1.0.78

[Danathar]

Duplicate of the root cause already written up on #939 (see the 2026-08-07 comment there: validate.yml has no types: filter, so edited never triggers a re-run). Keeping the fix discussion on #939.