fix(ci): release gate reads PR checks once and fails closed on gh errors

The second `gh pr checks` call ended in `|| true` with stderr discarded, so a
rate limit, 5xx or network failure left `bad` empty and the gate printed
"checks passed" and released.

One call now returns "<count>:<non-passing checks>". Output without that shape
(empty, an error page, garbage) is treated as unreadable and blocks.

tests/test_release_gate.py drives the script against a stubbed gh (7 cases:
direct push, red Validate, green/failing checks, gh error with no output,
garbage output, zero checks) and runs in validate-harness.

Falsified: disabling the count guard turns the gh-error and zero-checks cases
red (2 failures); restored, 7/7 OK.

Closes #322

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: TMHSDigital

.github/scripts/release-gate.sh

@@ -42,16 +42,21 @@ if [ -z "$pr" ]; then
 fi
 
 # gh exits non-zero while checks are pending or failing even with --json, so
-# judge the JSON itself (gh's built-in --jq, no jq binary needed) and treat
-# unreadable output as a failed gate.
-count=$(gh pr checks "$pr" --repo "$repo" --json name --jq 'length' 2>/dev/null) || true
+# judge the output, not the exit status. One call yields "<count>:<bad>", where
+# <bad> lists every check that did not pass or skip. Anything else means gh
+# could not read the checks (rate limit, 5xx, network): fail closed.
+out=$(gh pr checks "$pr" --repo "$repo" --json name,bucket \
+  --jq '"\(length):" + ([.[] | select(.bucket != "pass" and .bucket != "skipping") | "\(.name)=\(.bucket)"] | join(", "))' \
+  2>/dev/null) || true
+count=${out%%:*}
+bad=${out#*:}
+case "$out" in *:*) ;; *) count="" ;; esac
 case "$count" in
   ''|*[!0-9]*|0)
     echo "::error::could not read checks for PR #$pr; not releasing"
     exit 1
     ;;
 esac
-bad=$(gh pr checks "$pr" --repo "$repo" --json name,bucket   --jq '[.[] | select(.bucket != "pass" and .bucket != "skipping") | "\(.name)=\(.bucket)"] | join(", ")' 2>/dev/null) || true
 if [ -n "$bad" ]; then
   echo "::error::PR #$pr has checks that did not pass: $bad; not releasing"
   exit 1

.github/workflows/validate.yml

@@ -386,6 +386,9 @@ jobs:
       - name: Harness unit tests
         run: python3 tests/smoke/test_harness.py -v
 
+      - name: Release gate fails closed (stubbed gh)
+        run: python3 tests/test_release_gate.py -v
+
       - name: Hero-drift tool exit-code tests
         run: |
           pip install numpy==2.2.6 Pillow==11.2.1

tests/test_release_gate.py

@@ -0,0 +1,92 @@
+"""Exit-code tests for .github/scripts/release-gate.sh against a stubbed gh.
+
+The gate must fail closed: any gh error, empty output, or unparseable output
+blocks the release. Run: python tests/test_release_gate.py -v (needs bash).
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+GATE = REPO / ".github" / "scripts" / "release-gate.sh"
+# Resolve now: on Windows CreateProcess would find System32\bash.exe (WSL) first.
+BASH = shutil.which("bash")
+
+# Fake gh: behaviour comes from env vars so each test sets one scenario.
+#   FAKE_RUN     "<status> <conclusion>" for `gh run list`
+#   FAKE_PR      PR number for `gh api .../pulls` (empty = direct push)
+#   FAKE_CHECKS  stdout for `gh pr checks`; FAKE_CHECKS_RC its exit code
+FAKE_GH = r"""#!/usr/bin/env bash
+case "$1 $2" in
+  "run list") echo "${FAKE_RUN:-completed success}" ;;
+  "api "*) echo "${FAKE_PR:-}" ;;
+  "pr checks") printf '%s' "${FAKE_CHECKS:-}"; exit "${FAKE_CHECKS_RC:-0}" ;;
+  *) echo "unexpected gh $*" >&2; exit 99 ;;
+esac
+"""
+
+
+@unittest.skipIf(BASH is None, "bash not available")
+class ReleaseGate(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        gh = Path(self.tmp.name) / "gh"
+        gh.write_text(FAKE_GH, encoding="utf-8", newline="\n")
+        gh.chmod(0o755)
+
+    def tearDown(self):
+        self.tmp.cleanup()
+
+    def gate(self, **env):
+        full = dict(os.environ)
+        full.update(
+            PATH=self.tmp.name + os.pathsep + full.get("PATH", ""),
+            GITHUB_REPOSITORY="o/r",
+            SHA="abc123",
+            GATE_TIMEOUT="0",
+            GATE_POLL="0",
+        )
+        full.update(env)
+        proc = subprocess.run(
+            [BASH, GATE.as_posix()], env=full, capture_output=True, text=True
+        )
+        return proc.returncode, proc.stdout + proc.stderr
+
+    def test_direct_push_with_green_validate_passes(self):
+        self.assertEqual(self.gate(FAKE_PR="")[0], 0)
+
+    def test_red_validate_blocks(self):
+        code, out = self.gate(FAKE_RUN="completed failure")
+        self.assertEqual(code, 1)
+        self.assertIn("Validate concluded 'failure'", out)
+
+    def test_all_checks_green_passes(self):
+        code, out = self.gate(FAKE_PR="7", FAKE_CHECKS="3:")
+        self.assertEqual(code, 0, out)
+        self.assertIn("3 checks passed", out)
+
+    def test_failing_check_blocks(self):
+        code, out = self.gate(FAKE_PR="7", FAKE_CHECKS="3:smoke=fail", FAKE_CHECKS_RC="1")
+        self.assertEqual(code, 1)
+        self.assertIn("smoke=fail", out)
+
+    def test_gh_error_with_no_output_blocks(self):
+        code, out = self.gate(FAKE_PR="7", FAKE_CHECKS="", FAKE_CHECKS_RC="1")
+        self.assertEqual(code, 1)
+        self.assertIn("could not read checks", out)
+
+    def test_garbage_output_blocks(self):
+        code, _ = self.gate(FAKE_PR="7", FAKE_CHECKS="HTTP 502 Bad Gateway")
+        self.assertEqual(code, 1)
+
+    def test_zero_checks_blocks(self):
+        self.assertEqual(self.gate(FAKE_PR="7", FAKE_CHECKS="0:")[0], 1)
+
+
+if __name__ == "__main__":
+    unittest.main()