@plainconceptsplatform/workflows 0.19.2 → 0.20.0

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -1,260 +1,260 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-node-monorepo.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: "App: CI (Node monorepo)"
-
-on:
-  pull_request:
-  schedule:
-    - cron: "0 6 * * 1"
-  workflow_dispatch:
-
-env:
-  NODE_VERSION: "22"
-  PNPM_VERSION: "10"
-  WEB_PACKAGE: "@app/web"
-  DESKTOP_PACKAGE: "@app/desktop"
-  MOBILE_PACKAGE: "@app/mobile"
-  WEB_EXPORT_PATH: apps/web/out
-  PLAYWRIGHT_REPORT_PATH: apps/web/playwright-report
-  DESKTOP_MAIN_PATH: apps/desktop/out/main/index.js
-  DESKTOP_PRELOAD_PATH: apps/desktop/out/preload/index.cjs
-  DESKTOP_PRELOAD_BRIDGE_PATTERN: exposeInMainWorld
-  MOBILE_IOS_PATH: apps/mobile/ios
-  MOBILE_ANDROID_PATH: apps/mobile/android
-  WEB_ARTIFACT_NAME: web-export
-  PLAYWRIGHT_ARTIFACT_NAME: playwright-report
-  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
-  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
-  SBOM_ARTIFACT_NAME: app-sbom.cyclonedx.json
-  MUTATION_THRESHOLD: "60"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  lint:
-    name: Lint (Biome)
-    if: github.event_name != 'schedule'
-    runs-on: agents-arc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm exec biome check .
-
-  web:
-    name: Web (Next.js static export)
-    if: github.event_name != 'schedule'
-    runs-on: agents-arc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter "$WEB_PACKAGE" run typecheck
-      - run: pnpm --filter "$WEB_PACKAGE" run test
-      - run: pnpm --filter "$WEB_PACKAGE" run lint:fsd
-      - run: pnpm --filter "$WEB_PACKAGE" run build
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-        with:
-          name: ${{ env.WEB_ARTIFACT_NAME }}
-          path: ${{ env.WEB_EXPORT_PATH }}
-          retention-days: 3
-          if-no-files-found: error
-
-  mutation-web:
-    name: Mutation (web, diff)
-    if: github.event_name == 'pull_request'
-    runs-on: agents-arc
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
-      - name: Detect web changes
-        id: scope
-        run: |
-          git fetch origin "$GITHUB_BASE_REF" --depth=1
-          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^apps/web/"; then
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "No apps/web changes in this PR; skipping web mutation."
-          fi
-      - run: pnpm install --frozen-lockfile
-        if: steps.scope.outputs.run == 'true'
-      - name: StrykerJS (changed files only)
-        if: steps.scope.outputs.run == 'true'
-        run: pnpm --filter "$WEB_PACKAGE" exec stryker run --since="origin/$GITHUB_BASE_REF"
-
-  e2e:
-    name: E2E (Playwright)
-    if: github.event_name != 'schedule'
-    needs: web
-    runs-on: agents-arc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
-        with:
-          name: ${{ env.WEB_ARTIFACT_NAME }}
-          path: ${{ env.WEB_EXPORT_PATH }}
-      - run: pnpm --filter "$WEB_PACKAGE" exec playwright install --with-deps chromium webkit
-      - run: pnpm --filter "$WEB_PACKAGE" run e2e
-      - if: failure()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-        with:
-          name: ${{ env.PLAYWRIGHT_ARTIFACT_NAME }}
-          path: ${{ env.PLAYWRIGHT_REPORT_PATH }}
-          retention-days: 7
-
-  desktop:
-    name: Desktop (Electron)
-    if: github.event_name != 'schedule'
-    needs: web
-    runs-on: agents-arc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter "$DESKTOP_PACKAGE" run typecheck
-      - run: pnpm --filter "$DESKTOP_PACKAGE" run build
-      - run: |
-          test -f "$DESKTOP_MAIN_PATH"
-          test -f "$DESKTOP_PRELOAD_PATH"
-          grep -q "$DESKTOP_PRELOAD_BRIDGE_PATTERN" "$DESKTOP_PRELOAD_PATH"
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
-        with:
-          name: ${{ env.WEB_ARTIFACT_NAME }}
-          path: ${{ env.WEB_EXPORT_PATH }}
-      - run: pnpm --filter "$DESKTOP_PACKAGE" exec playwright install-deps chromium
-      - run: xvfb-run --auto-servernum pnpm --filter "$DESKTOP_PACKAGE" run e2e
-
-  mobile:
-    name: Mobile (Capacitor)
-    if: github.event_name != 'schedule'
-    runs-on: agents-arc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter "$MOBILE_PACKAGE" run typecheck
-      - run: |
-          if [ -d "$MOBILE_IOS_PATH" ] || [ -d "$MOBILE_ANDROID_PATH" ]; then
-            pnpm --filter "$WEB_PACKAGE" run build
-            pnpm --filter "$MOBILE_PACKAGE" run sync
-          else
-            echo "::notice::Native projects absent; skipping Capacitor sync."
-          fi
-
-  secret-scan:
-    name: Secret scan (TruffleHog)
-    runs-on: agents-arc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
-
-  deps-and-iac-scan:
-    name: Dependencies and IaC (Trivy)
-    runs-on: agents-arc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: fs
-          scanners: vuln,misconfig,secret
-          severity: CRITICAL,HIGH
-          ignore-unfixed: true
-          exit-code: "1"
-          format: table
-
-  sast-scan:
-    name: SAST (Semgrep)
-    runs-on: agents-arc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-
-  sbom:
-    name: SBOM (CycloneDX)
-    runs-on: agents-arc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
-        with:
-          format: cyclonedx-json
-          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
-
-  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
-  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
-  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
-  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
-  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
-  # route, which does fire for them. The reconcile belt remains the hourly fallback.
-  #
-  # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
-  # `actions: write`. A called workflow may not request a scope its caller withheld, and the
-  # whole run fails to start with zero jobs and no annotation when it does.
-  dispatch-merge-gate:
-    name: Dispatch merge gate
-    needs: [lint, web, mutation-web, e2e, desktop, mobile]
-    if: >
-      always() &&
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.draft == false &&
-      github.event.pull_request.user.type == 'Bot'
-    runs-on: agents-arc
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      actions: write
-    steps:
-      - name: Dispatch the merge gate with this run's verdict
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          REF: ${{ github.event.repository.default_branch }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          RUN_ID: ${{ github.run_id }}
-          RESULTS: ${{ join(needs.*.result, ' ') }}
-        run: |
-          set -euo pipefail
-          conclusion=success
-          for result in $RESULTS; do
-            case "$result" in
-              failure) conclusion=failure; break ;;
-              cancelled | timed_out) conclusion=cancelled ;;
-            esac
-          done
-          # A cancelled run was superseded by a newer push, whose own run dispatches.
-          if [ "$conclusion" = cancelled ]; then
-            echo "CI was cancelled; not dispatching the merge gate."
-            exit 0
-          fi
-          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
-          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
-            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
-            -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-node-monorepo.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "App: CI (Node monorepo)"
+
+on:
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+env:
+  NODE_VERSION: "22"
+  PNPM_VERSION: "10"
+  WEB_PACKAGE: "@app/web"
+  DESKTOP_PACKAGE: "@app/desktop"
+  MOBILE_PACKAGE: "@app/mobile"
+  WEB_EXPORT_PATH: apps/web/out
+  PLAYWRIGHT_REPORT_PATH: apps/web/playwright-report
+  DESKTOP_MAIN_PATH: apps/desktop/out/main/index.js
+  DESKTOP_PRELOAD_PATH: apps/desktop/out/preload/index.cjs
+  DESKTOP_PRELOAD_BRIDGE_PATTERN: exposeInMainWorld
+  MOBILE_IOS_PATH: apps/mobile/ios
+  MOBILE_ANDROID_PATH: apps/mobile/android
+  WEB_ARTIFACT_NAME: web-export
+  PLAYWRIGHT_ARTIFACT_NAME: playwright-report
+  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
+  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
+  SBOM_ARTIFACT_NAME: app-sbom.cyclonedx.json
+  MUTATION_THRESHOLD: "60"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lint:
+    name: Lint (Biome)
+    if: github.event_name != 'schedule'
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec biome check .
+
+  web:
+    name: Web (Next.js static export)
+    if: github.event_name != 'schedule'
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter "$WEB_PACKAGE" run typecheck
+      - run: pnpm --filter "$WEB_PACKAGE" run test
+      - run: pnpm --filter "$WEB_PACKAGE" run lint:fsd
+      - run: pnpm --filter "$WEB_PACKAGE" run build
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: ${{ env.WEB_ARTIFACT_NAME }}
+          path: ${{ env.WEB_EXPORT_PATH }}
+          retention-days: 3
+          if-no-files-found: error
+
+  mutation-web:
+    name: Mutation (web, diff)
+    if: github.event_name == 'pull_request'
+    runs-on: agents-arc
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
+      - name: Detect web changes
+        id: scope
+        run: |
+          git fetch origin "$GITHUB_BASE_REF" --depth=1
+          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^apps/web/"; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "No apps/web changes in this PR; skipping web mutation."
+          fi
+      - run: pnpm install --frozen-lockfile
+        if: steps.scope.outputs.run == 'true'
+      - name: StrykerJS (changed files only)
+        if: steps.scope.outputs.run == 'true'
+        run: pnpm --filter "$WEB_PACKAGE" exec stryker run --since="origin/$GITHUB_BASE_REF"
+
+  e2e:
+    name: E2E (Playwright)
+    if: github.event_name != 'schedule'
+    needs: web
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: ${{ env.WEB_ARTIFACT_NAME }}
+          path: ${{ env.WEB_EXPORT_PATH }}
+      - run: pnpm --filter "$WEB_PACKAGE" exec playwright install --with-deps chromium webkit
+      - run: pnpm --filter "$WEB_PACKAGE" run e2e
+      - if: failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: ${{ env.PLAYWRIGHT_ARTIFACT_NAME }}
+          path: ${{ env.PLAYWRIGHT_REPORT_PATH }}
+          retention-days: 7
+
+  desktop:
+    name: Desktop (Electron)
+    if: github.event_name != 'schedule'
+    needs: web
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter "$DESKTOP_PACKAGE" run typecheck
+      - run: pnpm --filter "$DESKTOP_PACKAGE" run build
+      - run: |
+          test -f "$DESKTOP_MAIN_PATH"
+          test -f "$DESKTOP_PRELOAD_PATH"
+          grep -q "$DESKTOP_PRELOAD_BRIDGE_PATTERN" "$DESKTOP_PRELOAD_PATH"
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: ${{ env.WEB_ARTIFACT_NAME }}
+          path: ${{ env.WEB_EXPORT_PATH }}
+      - run: pnpm --filter "$DESKTOP_PACKAGE" exec playwright install-deps chromium
+      - run: xvfb-run --auto-servernum pnpm --filter "$DESKTOP_PACKAGE" run e2e
+
+  mobile:
+    name: Mobile (Capacitor)
+    if: github.event_name != 'schedule'
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: "${{ env.PNPM_VERSION }}", run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: "${{ env.NODE_VERSION }}", cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter "$MOBILE_PACKAGE" run typecheck
+      - run: |
+          if [ -d "$MOBILE_IOS_PATH" ] || [ -d "$MOBILE_ANDROID_PATH" ]; then
+            pnpm --filter "$WEB_PACKAGE" run build
+            pnpm --filter "$MOBILE_PACKAGE" run sync
+          else
+            echo "::notice::Native projects absent; skipping Capacitor sync."
+          fi
+
+  secret-scan:
+    name: Secret scan (TruffleHog)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
+
+  deps-and-iac-scan:
+    name: Dependencies and IaC (Trivy)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scanners: vuln,misconfig,secret
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: "1"
+          format: table
+
+  sast-scan:
+    name: SAST (Semgrep)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
+
+  sbom:
+    name: SBOM (CycloneDX)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        with:
+          format: cyclonedx-json
+          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+
+  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
+  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
+  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
+  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
+  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
+  # route, which does fire for them. The reconcile belt remains the hourly fallback.
+  #
+  # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
+  # `actions: write`. A called workflow may not request a scope its caller withheld, and the
+  # whole run fails to start with zero jobs and no annotation when it does.
+  dispatch-merge-gate:
+    name: Dispatch merge gate
+    needs: [lint, web, mutation-web, e2e, desktop, mobile]
+    if: >
+      always() &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.type == 'Bot'
+    runs-on: agents-arc
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Dispatch the merge gate with this run's verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_ID: ${{ github.run_id }}
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          set -euo pipefail
+          conclusion=success
+          for result in $RESULTS; do
+            case "$result" in
+              failure) conclusion=failure; break ;;
+              cancelled | timed_out) conclusion=cancelled ;;
+            esac
+          done
+          # A cancelled run was superseded by a newer push, whose own run dispatches.
+          if [ "$conclusion" = cancelled ]; then
+            echo "CI was cancelled; not dispatching the merge gate."
+            exit 0
+          fi
+          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
+            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
+            -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"