fix(OMN-10970): wire skip-token rejection CI gate

[jonahgabriel]

Evidence-Ticket: OMN-10970
Evidence-Source: a84f3c6

Wire the reject-deploy-gate-skip reusable workflow as a caller in this repo. Ensures unapproved skip tokens are rejected org-wide.

dod_evidence:

• type: no_deployable_artifact
  description: CI workflow addition only — no runtime code modified

Summary by CodeRabbit

• Chores
  • Added a new automated workflow, "Reject skip-gate bypass tokens", to detect and reject skip-gate bypass tokens on pull requests and merge groups targeting main.
• Documentation
  • Added evidence/receipt entries documenting manual verification results for three PRs related to the gate enforcement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6153f358-6574-4a9f-a874-98b648917685

📥 Commits

Reviewing files that changed from the base of the PR and between 33963ec and f5a9bda.

📒 Files selected for processing (1)

• .github/workflows/call-reject-skip.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/call-reject-skip.yml

---

📝 Walkthrough

Walkthrough

Adds a repository workflow that invokes a hosted reusable workflow to reject skip-gate bypass tokens, and records three new OMN-10970 drift receipt files plus a contract update that lists those evidence items and their command checks.

Changes

Reject skip-gate gate + OMN-10970 receipts

Layer / File(s)	Summary
Workflow to call hosted reject-gate check .github/workflows/call-reject-skip.yml	New GitHub Actions workflow named "Reject skip-gate bypass tokens" triggered on pull_request (types: opened, edited, synchronize, reopened on main) and merge_group; sets contents: read, pull-requests: read; single job call-reject-skip-token invokes reusable workflow OmniNode-ai/omniclaude/.github/workflows/reject-deploy-gate-skip.yml@main via uses.
Contract: register new evidence items contracts/OMN-10970.yaml	Adds three dod_evidence entries (dod-omniintelligence-pr-650, dod-occ-pr-1006, dod-omniclaude-pr-1585) with manual sources and command checks that assert corresponding receipt files report status: PASS and the expected pr_number.
Drift receipts: manual command check results drift/dod_receipts/OMN-10970/dod-omniintelligence-pr-650/command.yaml, drift/dod_receipts/OMN-10970/dod-occ-pr-1006/command.yaml, drift/dod_receipts/OMN-10970/dod-omniclaude-pr-1585/command.yaml	Adds three receipt command.yaml files recording schema metadata, ticket/evidence IDs, check_type: command and check_value, status: PASS, run_timestamp, commit_sha, runner/verifier, pr_number, probe_command and probe_stdout, actual_output, and exit_code: 0.

Sequence Diagram

sequenceDiagram
  autonumber
  participant PR as Pull Request
  participant RepoWF as Repository Workflow (.github)
  participant HostedWF as Hosted Reusable Workflow (omniclaude)
  participant Contracts as Contracts/Receipts

  PR->>RepoWF: open/edit/synchronize/reopen (main) / merge_group
  RepoWF->>HostedWF: call reusable workflow (`uses`)
  HostedWF->>HostedWF: evaluate skip-gate token checks
  HostedWF-->>RepoWF: status check result (scan / reject-skip-gate-token)
  RepoWF->>Contracts: record/verify receipts & contract evidence (manual inputs)
  Contracts-->>RepoWF: PASS verification (receipt files show status: PASS)

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• OmniNode-ai/onex_change_control#1005: Related OMN-10970 contract/receipt additions updating evidence and receipts for skip-token enforcement.

Poem

🐰
I hopped through YAML, neat and bright,
Called a workflow in the quiet night,
Three receipts logged with PASS and time,
Exit code zero, tidy and prime,
A little guard, soft as a bite.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(OMN-10970): wire skip-token rejection CI gate' directly describes the main change: adding a GitHub Actions workflow to wire the skip-token rejection CI gate, as evidenced by the new .github/workflows/call-reject-skip.yml file and related contract/receipt updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-10970-wire-reject-deploy-gate-skip-on-all-remaining-repos-8

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/call-reject-skip.yml:
- Line 28: Remove the unnecessary secrets inheritance from the reusable-workflow
call: delete the "secrets: inherit" entry in the call that invokes
reject-deploy-gate-skip.yml (the reusable workflow only uses ${{ github.token }}
and declares no secret inputs), so omit the secrets block entirely to enforce
least privilege.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 87577e96-eb81-496b-8503-3ec429f0567e

📥 Commits

Reviewing files that changed from the base of the PR and between 7b6e353 and 86737ef.

📒 Files selected for processing (1)

• .github/workflows/call-reject-skip.yml