[imanimanyara]

Summary

The merge gate can report success having proven nothing. A run with no open Dependabot pull
requests never calls the checks API, so its exit code says only that the search came back empty —
never that the gate could have read a check had there been one.

This makes a quiet run earn its green: with nothing examined, the gate exercises the same
commits/{sha}/check-runs endpoint against a real commit and exits non-zero if that read fails.
Where pull requests were examined and every one errored, the summary names it as one systemic
failure rather than N unrelated ones.

The run this is written against

dependabot-merge.yml run 41713055813, 2026-11-03, scheduled. It failed with
Resource not accessible by integration (HTTP 403) on every pull request it examined, because at
that commit (a21ad90) bot/policy.json granted the job only {contents: write, pull-requests: write} — so the minted token had no checks: read. That was fixed next morning in
#21, and is not what this PR addresses.

What it addresses is how the failure presented:

org	open Dependabot PRs	job
brandgulp, ichava, laranail, mukoracms, simsange	0	green — never called the API
simtabi	1	green
simbi-prjs-clt	24	failed
tayariai	24	failed
tusente	19	failed
simbi-prjs-int	6	failed

Every pull request the gate examined errored, but it read as four isolated org problems. Had the
2026-11-02 branch sweep left nothing open anywhere, the run would have been 10/10 green over a gate
that could not read a single check.

This is the "assert non-vacuity first" rule the estate already applies elsewhere, and the same
shape as verify-release-publish.py, whose clean answer is likewise an empty result.

Not treated as failures

Two empty results genuinely are not permission problems, and checks_readable() returns None for
them rather than failing: an account with no repository to probe, and an empty repository answering
409.

Verification

• Suite: 21 → 27 tests, OK.

• The guard was proven to have teeth. Neutering the one line that raises the error count makes
  test_quiet_run_FAILS_when_checks_are_unreadable fail — FAILED (failures=1) — and restoring it
  returns 27 OK. The negative half is covered too: test_control_reports_absence_not_just_presence
  asserts the control can report False, so it is not a check that can only ever say "readable".

• Live dry runs, read-only, no --apply:

  laranail        → 0 open PRs; "checks API confirmed readable (verified on laranail/tayari-ui@main)"; exit 0
  simbi-prjs-clt  → 18 PRs, 0 error rows, exit 0
  tusente         → 19 PRs, 0 error rows, exit 0
  tayariai        → 17 PRs, 0 error rows, exit 0
  simbi-prjs-int  →  6 PRs, 0 error rows, exit 0
  

  All four of those orgs were 100% error rows on 2026-11-03, so this also independently confirms
  bot: widen the ceiling to the reads the merge gate needs #21 fixed the permission.

Note

DEPENDABOT_MERGE_APPLY is now true (set 2026-11-04), so the next scheduled run is the first
armed one. Nothing here changes what the gate merges — only whether it may report success without
having looked.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.