code-mower 0.5.0b50__tar.gz → 0.5.0b51__tar.gz

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b50
+Version: 0.5.0b51
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b50
+pipx install --python python3.12 code-mower==0.5.0b51
 code-mower --version
 ```
 
-`0.5.0b50` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b51` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -155,7 +155,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b50`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b51`.
 
 ## Optional: Plan Before Coding
 
@@ -310,9 +310,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.50` from
+The current public beta is `v0.5.0-beta.51` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b50` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b51` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/README.md

@@ -88,11 +88,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b50
+pipx install --python python3.12 code-mower==0.5.0b51
 code-mower --version
 ```
 
-`0.5.0b50` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b51` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -140,7 +140,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b50`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b51`.
 
 ## Optional: Plan Before Coding
 
@@ -295,9 +295,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.50` from
+The current public beta is `v0.5.0-beta.51` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b50` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b51` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b50"
+version = "0.5.0b51"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b50"
+__version__ = "0.5.0b51"

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/src/code_mower/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 if __package__ in {None, ""}:
     raise SystemExit(
         "code_mower.cli is a packaged entrypoint. Install Code Mower with "
-        "`pipx install code-mower==0.5.0b50`, or run source checkouts with "
+        "`pipx install code-mower==0.5.0b51`, or run source checkouts with "
         "`PYTHONPATH=src python -m code_mower.cli`."
     )
 

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/src/code_mower/doctor_checks/github_branch.py

@@ -8,6 +8,8 @@ from typing import Mapping
 from .common import DoctorCheck, STATUS_PASS, STATUS_WARN
 from .github_api import _github_api_json
 
+GITHUB_ACTIONS_APP_ID = 15368
+
 
 def check_branch_protection(
     *,
@@ -41,6 +43,7 @@ def check_branch_protection(
 
     required_checks = protection_payload.get("required_status_checks")
     contexts: list[str] = []
+    check_bindings: list[dict[str, object]] = []
     if isinstance(required_checks, Mapping):
         raw_contexts = required_checks.get("contexts")
         if isinstance(raw_contexts, list):
@@ -49,8 +52,42 @@ def check_branch_protection(
         if isinstance(raw_checks, list):
             for check in raw_checks:
                 if isinstance(check, Mapping) and check.get("context"):
-                    contexts.append(str(check["context"]))
+                    context = str(check["context"])
+                    contexts.append(context)
+                    check_bindings.append(
+                        {"context": context, "app_id": check.get("app_id")}
+                    )
     contexts = list(dict.fromkeys(contexts))
+    wrong_gate_bindings = [
+        binding
+        for binding in check_bindings
+        if binding.get("context") == required_status_context
+        and binding.get("app_id") == GITHUB_ACTIONS_APP_ID
+    ]
+    if required_status_context and wrong_gate_bindings:
+        return DoctorCheck(
+            name="github.branch_protection",
+            status=STATUS_WARN,
+            message=(
+                f"{slug}@{default_branch} requires {required_status_context} "
+                "from GitHub Actions instead of Any source"
+            ),
+            detail={
+                "repo": slug,
+                "default_branch": default_branch,
+                "required_status_context": required_status_context,
+                "required_status_contexts": contexts,
+                "required_status_check_count": len(contexts),
+                "required_status_check_bindings": check_bindings,
+            },
+            remediation=(
+                f"Rebind `{required_status_context}` in branch protection to "
+                "Any source, not GitHub Actions. In the API response, the "
+                f"`checks[]` entry for `{required_status_context}` should have "
+                "`app_id: null`; `app_id: 15368` means GitHub is evaluating "
+                "the Actions job check-run instead of the Code Mower commit status."
+            ),
+        )
     if required_status_context and required_status_context not in contexts:
         return DoctorCheck(
             name="github.branch_protection",
@@ -70,7 +107,7 @@ def check_branch_protection(
                 "unattended merge. Inspect existing checks with "
                 f"`gh api repos/{slug}/branches/{encoded_branch}/protection/required_status_checks`, "
                 "then PATCH that endpoint with all existing contexts plus "
-                f"`{required_status_context}`."
+                f"`{required_status_context}` from Any source."
             ),
         )
     return DoctorCheck(
@@ -86,5 +123,6 @@ def check_branch_protection(
             "default_branch": default_branch,
             "required_status_check_count": len(contexts),
             "required_status_contexts": contexts,
+            "required_status_check_bindings": check_bindings,
         },
     )

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/src/code_mower/init.py

@@ -1828,6 +1828,18 @@ def render_init_plan(
         lines.extend(["", "Additional repository targets from --add-repo:"])
         lines.extend(f"- {slug}" for slug in add_repositories)
 
+    if merge_authority_lanes:
+        lines.extend(
+            [
+                "",
+                "Branch protection:",
+                "- require `code-mower/gate` from Any source "
+                "(API checks[].app_id: null), not GitHub Actions "
+                "(app_id: 15368)",
+                "- inspect: gh api repos/OWNER/REPO/branches/main/protection/required_status_checks",
+            ]
+        )
+
     lines.extend(["", "Required secrets/PAT fallbacks:"])
     if data["required_secrets"]:
         lines.extend(f"- {secret}" for secret in data["required_secrets"])

{code_mower-0.5.0b50 → code_mower-0.5.0b51/src/code_mower}/templates/workflows/builder-provenance.yml.j2

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 env:
-  CODE_MOWER_PACKAGE_SPEC: code-mower==0.5.0b41
+  CODE_MOWER_PACKAGE_SPEC: code-mower==0.5.0b51
 
 jobs:
   auto-record:

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/src/code_mower/templates/workflows/code-mower-agent-pr-labeler.yml.j2

@@ -88,6 +88,32 @@ jobs:
             echo "::error::${CODE_MOWER_DISPATCH_TOKEN_ENV} secret is missing; labels must be applied by a human-owned token so audit workflows trigger"
             exit 1
           fi
+          code_mower_handle_rate_limit() {
+            rate_limited=false
+            for file in "$@"; do
+              if [ -s "${file}" ] && grep -qiE 'API rate limit exceeded|rate limit' "${file}"; then
+                rate_limited=true
+              fi
+            done
+            [ "${rate_limited}" = "true" ] || return 1
+
+            reset_epoch="$(gh api rate_limit --jq '.resources.core.reset // .rate.reset // ""' 2>/dev/null || true)"
+            if [[ "${reset_epoch}" =~ ^[0-9]+$ ]]; then
+              now_epoch="$(date -u +%s)"
+              wait_seconds=$((reset_epoch - now_epoch + 5))
+              reset_iso="$(date -u -d "@${reset_epoch}" "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || echo "${reset_epoch}")"
+              if [ "${wait_seconds}" -gt 0 ] && [ "${wait_seconds}" -le 240 ]; then
+                echo "::notice::GitHub API rate limit hit; backing off until ${reset_iso}."
+                sleep "${wait_seconds}"
+              else
+                echo "::notice::GitHub API rate limit hit; reset at ${reset_iso}; exiting cleanly so a later event can retry."
+              fi
+            else
+              echo "::notice::GitHub API rate limit hit; reset time unavailable; exiting cleanly so a later event can retry."
+            fi
+            return 0
+          }
+
           mapfile -t remove_labels < .code-mower-agent-remove-labels.txt
           mapfile -t add_labels < .code-mower-agent-add-labels.txt
           remove_args=()
@@ -101,5 +127,12 @@ jobs:
           for label in "${add_labels[@]}"; do
             [ -n "${label}" ] && add_args+=(--add-label "${label}")
           done
-          gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" "${add_args[@]}"
+          label_error="$(mktemp)"
+          if ! gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" "${add_args[@]}" 2>"${label_error}"; then
+            if code_mower_handle_rate_limit "${label_error}"; then
+              exit 0
+            fi
+            cat "${label_error}" >&2
+            exit 1
+          fi
           printf '#%s (%s): %s\n' "${PR_NUMBER}" "${PR_ACTION}" "$(paste -sd ', ' .code-mower-agent-add-labels.txt)"

{code_mower-0.5.0b50 → code_mower-0.5.0b51/src/code_mower}/templates/workflows/code-mower-fix-round-dispatch.yml.j2

@@ -97,7 +97,42 @@ jobs:
             echo "::error::${CODE_MOWER_DISPATCH_TOKEN_ENV} secret is missing or empty; fix-round mentions must be posted by a human-owned token"
             exit 1
           fi
-          bodies="$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate -q '.[].body')"
+          code_mower_handle_rate_limit() {
+            rate_limited=false
+            for file in "$@"; do
+              if [ -s "${file}" ] && grep -qiE 'API rate limit exceeded|rate limit' "${file}"; then
+                rate_limited=true
+              fi
+            done
+            [ "${rate_limited}" = "true" ] || return 1
+
+            reset_epoch="$(gh api rate_limit --jq '.resources.core.reset // .rate.reset // ""' 2>/dev/null || true)"
+            if [[ "${reset_epoch}" =~ ^[0-9]+$ ]]; then
+              now_epoch="$(date -u +%s)"
+              wait_seconds=$((reset_epoch - now_epoch + 5))
+              reset_iso="$(date -u -d "@${reset_epoch}" "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || echo "${reset_epoch}")"
+              if [ "${wait_seconds}" -gt 0 ] && [ "${wait_seconds}" -le 240 ]; then
+                echo "::notice::GitHub API rate limit hit; backing off until ${reset_iso}."
+                sleep "${wait_seconds}"
+              else
+                echo "::notice::GitHub API rate limit hit; reset at ${reset_iso}; exiting cleanly so a later event can retry."
+              fi
+            else
+              echo "::notice::GitHub API rate limit hit; reset time unavailable; exiting cleanly so a later event can retry."
+            fi
+            return 0
+          }
+
+          comments_output="$(mktemp)"
+          comments_error="$(mktemp)"
+          if ! gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate -q '.[].body' >"${comments_output}" 2>"${comments_error}"; then
+            if code_mower_handle_rate_limit "${comments_error}" "${comments_output}"; then
+              exit 0
+            fi
+            cat "${comments_error}" >&2
+            exit 1
+          fi
+          bodies="$(cat "${comments_output}")"
           if printf '%s' "${bodies}" | grep -qF -- "${MARKER}"; then
             echo "fix round already dispatched for ${HEAD_SHA} (${AUDIT_LANE}/${BUILDER_LANE})"
             exit 0
@@ -107,5 +142,12 @@ jobs:
           body="${FIX_ROUND_MENTION} The **${AUDIT_LANE}** audit lane BLOCKED this PR (head ${short_sha}). Read the latest Code Mower audit comments on this PR, address every blocking finding without scope additions, push to this branch, then re-add: \`${needs_labels}\`. If a finding is wrong, reply with evidence and add \`${NEEDS_OWNER_LABEL}\`.
 
           ${MARKER}"
-          gh pr comment "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "${body}"
+          comment_error="$(mktemp)"
+          if ! gh pr comment "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "${body}" 2>"${comment_error}"; then
+            if code_mower_handle_rate_limit "${comment_error}"; then
+              exit 0
+            fi
+            cat "${comment_error}" >&2
+            exit 1
+          fi
           echo "dispatched fix round for #${PR_NUMBER} (${AUDIT_LANE}/${BUILDER_LANE}, ${short_sha})"

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/src/code_mower/templates/workflows/code-mower-gate.yml.j2

@@ -38,7 +38,7 @@ env:
 
 jobs:
   gate:
-    name: code-mower/gate
+    name: publish Code Mower gate status
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -590,6 +590,8 @@ __GATE_AUTHOR_ENV_ASSIGNMENTS__
 
           echo "Code Mower gate: ${gate_state} - ${gate_description}"
 
+          # The merge signal is the commit status above. Keep expected
+          # pending/failure verdicts from creating a second required check-run.
           if [ "${gate_state}" != "success" ] || [ "${CODE_MOWER_GATE_ENABLE_AUTO_MERGE}" != "true" ]; then
             exit 0
           fi

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/src/code_mower.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b50
+Version: 0.5.0b51
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b50
+pipx install --python python3.12 code-mower==0.5.0b51
 code-mower --version
 ```
 
-`0.5.0b50` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b51` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -155,7 +155,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b50`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b51`.
 
 ## Optional: Plan Before Coding
 
@@ -310,9 +310,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.50` from
+The current public beta is `v0.5.0-beta.51` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b50` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b51` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b50/src/code_mower → code_mower-0.5.0b51}/templates/workflows/builder-provenance.yml.j2

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 env:
-  CODE_MOWER_PACKAGE_SPEC: code-mower==0.5.0b50
+  CODE_MOWER_PACKAGE_SPEC: code-mower==0.5.0b51
 
 jobs:
   auto-record:

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/templates/workflows/code-mower-agent-pr-labeler.yml.j2

@@ -88,6 +88,32 @@ jobs:
             echo "::error::${CODE_MOWER_DISPATCH_TOKEN_ENV} secret is missing; labels must be applied by a human-owned token so audit workflows trigger"
             exit 1
           fi
+          code_mower_handle_rate_limit() {
+            rate_limited=false
+            for file in "$@"; do
+              if [ -s "${file}" ] && grep -qiE 'API rate limit exceeded|rate limit' "${file}"; then
+                rate_limited=true
+              fi
+            done
+            [ "${rate_limited}" = "true" ] || return 1
+
+            reset_epoch="$(gh api rate_limit --jq '.resources.core.reset // .rate.reset // ""' 2>/dev/null || true)"
+            if [[ "${reset_epoch}" =~ ^[0-9]+$ ]]; then
+              now_epoch="$(date -u +%s)"
+              wait_seconds=$((reset_epoch - now_epoch + 5))
+              reset_iso="$(date -u -d "@${reset_epoch}" "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || echo "${reset_epoch}")"
+              if [ "${wait_seconds}" -gt 0 ] && [ "${wait_seconds}" -le 240 ]; then
+                echo "::notice::GitHub API rate limit hit; backing off until ${reset_iso}."
+                sleep "${wait_seconds}"
+              else
+                echo "::notice::GitHub API rate limit hit; reset at ${reset_iso}; exiting cleanly so a later event can retry."
+              fi
+            else
+              echo "::notice::GitHub API rate limit hit; reset time unavailable; exiting cleanly so a later event can retry."
+            fi
+            return 0
+          }
+
           mapfile -t remove_labels < .code-mower-agent-remove-labels.txt
           mapfile -t add_labels < .code-mower-agent-add-labels.txt
           remove_args=()
@@ -101,5 +127,12 @@ jobs:
           for label in "${add_labels[@]}"; do
             [ -n "${label}" ] && add_args+=(--add-label "${label}")
           done
-          gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" "${add_args[@]}"
+          label_error="$(mktemp)"
+          if ! gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" "${add_args[@]}" 2>"${label_error}"; then
+            if code_mower_handle_rate_limit "${label_error}"; then
+              exit 0
+            fi
+            cat "${label_error}" >&2
+            exit 1
+          fi
           printf '#%s (%s): %s\n' "${PR_NUMBER}" "${PR_ACTION}" "$(paste -sd ', ' .code-mower-agent-add-labels.txt)"

{code_mower-0.5.0b50/src/code_mower → code_mower-0.5.0b51}/templates/workflows/code-mower-fix-round-dispatch.yml.j2

@@ -97,7 +97,42 @@ jobs:
             echo "::error::${CODE_MOWER_DISPATCH_TOKEN_ENV} secret is missing or empty; fix-round mentions must be posted by a human-owned token"
             exit 1
           fi
-          bodies="$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate -q '.[].body')"
+          code_mower_handle_rate_limit() {
+            rate_limited=false
+            for file in "$@"; do
+              if [ -s "${file}" ] && grep -qiE 'API rate limit exceeded|rate limit' "${file}"; then
+                rate_limited=true
+              fi
+            done
+            [ "${rate_limited}" = "true" ] || return 1
+
+            reset_epoch="$(gh api rate_limit --jq '.resources.core.reset // .rate.reset // ""' 2>/dev/null || true)"
+            if [[ "${reset_epoch}" =~ ^[0-9]+$ ]]; then
+              now_epoch="$(date -u +%s)"
+              wait_seconds=$((reset_epoch - now_epoch + 5))
+              reset_iso="$(date -u -d "@${reset_epoch}" "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || echo "${reset_epoch}")"
+              if [ "${wait_seconds}" -gt 0 ] && [ "${wait_seconds}" -le 240 ]; then
+                echo "::notice::GitHub API rate limit hit; backing off until ${reset_iso}."
+                sleep "${wait_seconds}"
+              else
+                echo "::notice::GitHub API rate limit hit; reset at ${reset_iso}; exiting cleanly so a later event can retry."
+              fi
+            else
+              echo "::notice::GitHub API rate limit hit; reset time unavailable; exiting cleanly so a later event can retry."
+            fi
+            return 0
+          }
+
+          comments_output="$(mktemp)"
+          comments_error="$(mktemp)"
+          if ! gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate -q '.[].body' >"${comments_output}" 2>"${comments_error}"; then
+            if code_mower_handle_rate_limit "${comments_error}" "${comments_output}"; then
+              exit 0
+            fi
+            cat "${comments_error}" >&2
+            exit 1
+          fi
+          bodies="$(cat "${comments_output}")"
           if printf '%s' "${bodies}" | grep -qF -- "${MARKER}"; then
             echo "fix round already dispatched for ${HEAD_SHA} (${AUDIT_LANE}/${BUILDER_LANE})"
             exit 0
@@ -107,5 +142,12 @@ jobs:
           body="${FIX_ROUND_MENTION} The **${AUDIT_LANE}** audit lane BLOCKED this PR (head ${short_sha}). Read the latest Code Mower audit comments on this PR, address every blocking finding without scope additions, push to this branch, then re-add: \`${needs_labels}\`. If a finding is wrong, reply with evidence and add \`${NEEDS_OWNER_LABEL}\`.
 
           ${MARKER}"
-          gh pr comment "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "${body}"
+          comment_error="$(mktemp)"
+          if ! gh pr comment "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "${body}" 2>"${comment_error}"; then
+            if code_mower_handle_rate_limit "${comment_error}"; then
+              exit 0
+            fi
+            cat "${comment_error}" >&2
+            exit 1
+          fi
           echo "dispatched fix round for #${PR_NUMBER} (${AUDIT_LANE}/${BUILDER_LANE}, ${short_sha})"

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/templates/workflows/code-mower-gate.yml.j2

@@ -38,7 +38,7 @@ env:
 
 jobs:
   gate:
-    name: code-mower/gate
+    name: publish Code Mower gate status
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -590,6 +590,8 @@ __GATE_AUTHOR_ENV_ASSIGNMENTS__
 
           echo "Code Mower gate: ${gate_state} - ${gate_description}"
 
+          # The merge signal is the commit status above. Keep expected
+          # pending/failure verdicts from creating a second required check-run.
           if [ "${gate_state}" != "success" ] || [ "${CODE_MOWER_GATE_ENABLE_AUTO_MERGE}" != "true" ]; then
             exit 0
           fi

{code_mower-0.5.0b50 → code_mower-0.5.0b51}/tests/test_doctor_github_checks.py

@@ -368,14 +368,14 @@ class GitHubDoctorCheckTests(unittest.TestCase):
         self.assertIn("code-mower/gate", check.message)
         self.assertEqual(check.detail["required_status_context"], "code-mower/gate")
 
-    def test_branch_protection_accepts_gate_status_from_checks_array(self) -> None:
+    def test_branch_protection_accepts_any_source_gate_status_binding(self) -> None:
         with mock.patch(
             "code_mower.doctor_checks.github_branch._github_api_json",
             return_value=(
                 {
                     "required_status_checks": {
                         "contexts": ["ci"],
-                        "checks": [{"context": "code-mower/gate"}],
+                        "checks": [{"context": "code-mower/gate", "app_id": None}],
                     }
                 },
                 {},
@@ -391,6 +391,39 @@ class GitHubDoctorCheckTests(unittest.TestCase):
 
         self.assertEqual(check.status, "pass")
         self.assertIn("code-mower/gate", check.detail["required_status_contexts"])
+        self.assertEqual(
+            check.detail["required_status_check_bindings"],
+            [{"context": "code-mower/gate", "app_id": None}],
+        )
+
+    def test_branch_protection_warns_when_gate_status_bound_to_actions(self) -> None:
+        with mock.patch(
+            "code_mower.doctor_checks.github_branch._github_api_json",
+            return_value=(
+                {
+                    "required_status_checks": {
+                        "contexts": ["code-mower/gate"],
+                        "checks": [{"context": "code-mower/gate", "app_id": 15368}],
+                    }
+                },
+                {},
+            ),
+        ):
+            check = check_branch_protection(
+                gh_path="/usr/bin/gh",
+                slug="owner/repo",
+                default_branch="main",
+                http_timeout=1,
+                required_status_context="code-mower/gate",
+            )
+
+        self.assertEqual(check.status, "warn")
+        self.assertIn("GitHub Actions instead of Any source", check.message)
+        self.assertIn("app_id: null", check.remediation)
+        self.assertEqual(
+            check.detail["required_status_check_bindings"],
+            [{"context": "code-mower/gate", "app_id": 15368}],
+        )
 
     def test_repo_auto_merge_warns_when_disabled(self) -> None:
         check = check_repo_auto_merge(