fix(skills): use latest check-run attempts

.agents/skills/nemoclaw-maintainer-day/scripts/shared.ts

@@ -104,6 +104,10 @@ export interface StatusCheck {
   __typename?: string;
   name?: string; // CheckRun field
   context?: string; // StatusContext field
+  workflowName?: string; // CheckRun workflow identity
+  startedAt?: string; // CheckRun/StatusContext RFC3339 timestamp
+  completedAt?: string; // CheckRun RFC3339 timestamp
+  detailsUrl?: string; // CheckRun workflow-run identity when Actions produced it
   status?: string; // CheckRun: COMPLETED, IN_PROGRESS, QUEUED, etc.
   conclusion?: string; // CheckRun: SUCCESS, FAILURE, NEUTRAL, SKIPPED, etc.
   state?: string; // StatusContext: SUCCESS, FAILURE, PENDING, ERROR

.agents/skills/nemoclaw-maintainer-pr-comparator/scripts/collect-gates.sh

@@ -41,7 +41,7 @@ else
 fi
 
 raw=$(gh pr view "$pr" "${repo_args[@]}" \
-  --json number,state,body,headRefOid,statusCheckRollup,mergeable,mergeStateStatus,reviewDecision \
+  --json number,state,body,author,headRefOid,statusCheckRollup,mergeable,mergeStateStatus,reviewDecision \
   2>/dev/null) || {
   emit_error "fetch_failed"
   exit 0
@@ -106,6 +106,12 @@ if printf '%s' "$raw" | jq -r '.body // ""' | grep -Eq '^Signed-off-by:[[:space:
 else
   dco_declaration_present=false
 fi
+author_login=$(printf '%s' "$raw" | jq -r '.author.login // ""' | tr '[:upper:]' '[:lower:]')
+if [ "$author_login" = "app/dependabot" ] || [ "$author_login" = "dependabot[bot]" ]; then
+  dco_declaration_bypassed=true
+else
+  dco_declaration_bypassed=false
+fi
 
 commits_fetch_failed=false
 commit_parse_failed=false
@@ -122,7 +128,8 @@ elif commits_json=$(printf '%s\n' "$commits_raw" | jq -s '.' 2>/dev/null); then
   unverified_commits=$(printf '%s' "$commits_json" | jq '[.[] | select(.verified != true) | {sha, reason}]')
   unverified_count=$(printf '%s' "$unverified_commits" | jq 'length')
   gate_contributor_compliance=$(
-    [ "$dco_declaration_present" = "true" ] && [ "$unverified_count" = "0" ] && echo true || echo false
+    { [ "$dco_declaration_present" = "true" ] || [ "$dco_declaration_bypassed" = "true" ]; } \
+      && [ "$unverified_count" = "0" ] && echo true || echo false
   )
 else
   commit_count=0
@@ -166,6 +173,7 @@ jq -n \
   --arg mergeable "$mergeable" \
   --arg merge_state "$merge_state" \
   --argjson dco_declaration_present "$dco_declaration_present" \
+  --argjson dco_declaration_bypassed "$dco_declaration_bypassed" \
   --argjson commit_count "$commit_count" \
   --argjson unverified_commits "$unverified_commits" \
   --argjson commit_fetch_failed "$commits_fetch_failed" \
@@ -192,6 +200,7 @@ jq -n \
       mergeable: $mergeable,
       merge_state_status: $merge_state,
       dco_declaration_present: $dco_declaration_present,
+      dco_declaration_bypassed: $dco_declaration_bypassed,
       commit_count: $commit_count,
       unverified_commits: $unverified_commits,
       commit_fetch_failed: $commit_fetch_failed,

.github/workflows/dco-check.yaml

@@ -16,26 +16,24 @@ concurrency:
 
 jobs:
   dco-check:
-    if: github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
       contents: read
     steps:
-      - name: Check out repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Check DCO bypass list
+      - name: Check Dependabot DCO bypass
         id: dco-bypass
         env:
           USERNAME: ${{ github.event.pull_request.user.login }}
         run: |
-          if grep -Fxq "$USERNAME" .github/dco-bypass.txt; then
+          # GitHub exposes the same trusted app as dependabot[bot] in event
+          # payloads and app/dependabot through some GraphQL PR surfaces.
+          if [[ "$USERNAME" == "dependabot[bot]" || "$USERNAME" == "app/dependabot" ]]; then
             echo "bypass=true" >> "$GITHUB_OUTPUT"
-            echo "Author is in dco-bypass.txt; skipping DCO sign-off requirement."
+            echo "Dependabot is exempt from the PR-body DCO declaration."
           else
             echo "bypass=false" >> "$GITHUB_OUTPUT"
-            echo "Author is not in dco-bypass.txt; DCO sign-off is required."
+            echo "The PR-body DCO declaration is required."
           fi
 
       - name: Check PR body for Signed-off-by

.github/workflows/installer-hash-check.yaml

@@ -11,9 +11,16 @@
 
 name: Security / Installer Hash Check
 
+run-name: >-
+  ${{ github.event_name == 'pull_request' &&
+  format('Installer Hash PR #{0} head {1} base {2} gate true',
+  github.event.pull_request.number, github.event.pull_request.head.sha,
+  github.event.pull_request.base.sha) ||
+  format('Installer Hash {0} {1}', github.event_name, github.sha) }}
+
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, edited]
   push:
     branches: [main]
   schedule:

.github/workflows/pr-e2e-gate.yaml

@@ -3,6 +3,14 @@
 
 name: E2E / PR Gate Controller
 
+run-name: >-
+  ${{ github.event_name == 'pull_request_target' &&
+  format('E2E Gate PR #{0} head {1} base {2} gate {3}',
+  github.event.pull_request.number, github.event.pull_request.head.sha,
+  github.event.pull_request.base.sha,
+  github.event.action != 'edited' || github.event.changes.base != null) ||
+  format('E2E Gate {0} {1}', github.event_name, github.run_id) }}
+
 on:
   workflow_run:
     workflows: ["CI / Pull Request"]

ci/source-shape-test-budget.json

@@ -396,6 +396,16 @@
       "test": "publishes coverage only from same-repository code (#6692)",
       "category": "security"
     },
+    {
+      "file": "test/pr-workflow-contract.test.ts",
+      "test": "records the Dependabot DCO bypass as a successful required job",
+      "category": "security"
+    },
+    {
+      "file": "test/pr-workflow-contract.test.ts",
+      "test": "reruns installer hash verification after a pull request base retarget",
+      "category": "security"
+    },
     {
       "file": "test/pr-workflow-contract.test.ts",
       "test": "reuses the same shared CI actions in PR and main workflows",

test/pr-e2e-gate-workflow.test.ts

@@ -26,6 +26,7 @@ type CoordinatorJob = WorkflowJob & {
 
 type TriggeredWorkflow = Omit<Workflow, "jobs"> & {
   name: string;
+  "run-name": string;
   on: {
     workflow_run: { workflows: string[]; types: string[] };
     pull_request_target: { types: string[] };
@@ -304,6 +305,11 @@ describe("PR E2E gate workflow", () => {
     const recordForkSkip = workflow.jobs["record-fork-e2e-skip"];
 
     expect(workflow.name).toBe("E2E / PR Gate Controller");
+    expect(workflow["run-name"]).toContain("E2E Gate PR #{0} head {1} base {2} gate {3}");
+    expect(workflow["run-name"]).toContain("github.event.pull_request.number");
+    expect(workflow["run-name"]).toContain("github.event.pull_request.head.sha");
+    expect(workflow["run-name"]).toContain("github.event.pull_request.base.sha");
+    expect(workflow["run-name"]).toContain("github.event.changes.base != null");
     expect(workflow.on).toEqual({
       workflow_run: {
         workflows: ["CI / Pull Request"],

test/pr-workflow-contract.test.ts

@@ -276,6 +276,7 @@ function codeFilterMatchesChangedPaths(workflow: CiWorkflow, paths: string[]): b
 describe("pull request and main workflow contracts", () => {
   const prWorkflow = readYaml<CiWorkflow>(".github/workflows/pr.yaml");
   const mainWorkflow = readYaml<CiWorkflow>(".github/workflows/main.yaml");
+  const dcoWorkflow = readYaml<CiWorkflow>(".github/workflows/dco-check.yaml");
   const installerHashWorkflow = readYaml<CiWorkflow>(".github/workflows/installer-hash-check.yaml");
   const installerHashAction = readYaml<InstallerHashAction>(
     ".github/actions/ci-installer-hash-check/action.yaml",
@@ -299,6 +300,35 @@ describe("pull request and main workflow contracts", () => {
       ".github/actions/ci-installer-integration/action.yaml",
     ),
   };
+
+  // source-shape-contract: security -- Base retargets must rerun trusted installer verification without minting skipped required evidence
+  it("reruns installer hash verification after a pull request base retarget", () => {
+    expect(installerHashWorkflow.on?.pull_request?.types).toEqual([
+      "opened",
+      "synchronize",
+      "reopened",
+      "edited",
+    ]);
+    expect(installerHashWorkflow.jobs["check-hash"].if).toBe(
+      "github.repository == 'NVIDIA/NemoClaw'",
+    );
+  });
+
+  // source-shape-contract: security -- Dependabot's bounded DCO exemption must report an explicit successful required check
+  it("records the Dependabot DCO bypass as a successful required job", () => {
+    const job = dcoWorkflow.jobs["dco-check"];
+    const bypass = requiredWorkflowStep(job, "Check Dependabot DCO bypass");
+    const declaration = requiredWorkflowStep(job, "Check PR body for Signed-off-by");
+
+    expect(job.if).toBeUndefined();
+    expect(job.steps?.some((step) => step.uses?.startsWith("actions/checkout@"))).toBe(false);
+    expect(bypass.env?.USERNAME).toBe("${{ github.event.pull_request.user.login }}");
+    expect(bypass.run).toContain('"$USERNAME" == "dependabot[bot]"');
+    expect(bypass.run).toContain('"$USERNAME" == "app/dependabot"');
+    expect(bypass.run).not.toContain(".github/dco-bypass.txt");
+    expect(declaration.if).toBe("${{ steps.dco-bypass.outputs.bypass != 'true' }}");
+  });
+
   // source-shape-contract: security -- Installer hashes must be verified by base-trusted or immutable bootstrap code
   it("runs pull request installer verification from immutable trusted code", () => {
     const job = installerHashWorkflow.jobs["check-hash"];
@@ -338,6 +368,18 @@ describe("pull request and main workflow contracts", () => {
     );
 
     expect(installerHashWorkflow.on?.pull_request?.paths).toBeUndefined();
+    expect(installerHashWorkflow.on?.pull_request?.types).toEqual([
+      "opened",
+      "synchronize",
+      "reopened",
+      "edited",
+    ]);
+    expect(installerHashWorkflow["run-name"]).toContain(
+      "Installer Hash PR #{0} head {1} base {2} gate true",
+    );
+    expect(installerHashWorkflow["run-name"]).toContain("github.event.pull_request.base.sha");
+    expect(installerHashWorkflow["run-name"]).not.toContain("github.event.changes.base");
+    expect(job.if).toBe("github.repository == 'NVIDIA/NemoClaw'");
     expect(installerHashWorkflow.permissions).toEqual({ contents: "read" });
     expect(parserRuntimeSetup.uses).toBe(trustedSetupNodeAction);
     expect(parserRuntimeSetup.with?.["node-version"]).toBe("22.19.0");