fix: add secrets:read to qa/security-review + queue script

- Add secrets:read to qa-review.yml and security-review.yml permissions
  block so SOP_TIER_CHECK_TOKEN can be read at workflow runtime.
  Without this, Gitea Actions omits the secret from the environment and
  the API call fails (internal#325).
- Add E2E Chat, qa-review, and security-review to REQUIRED_CONTEXTS so
  the queue correctly skips PRs with failing gates instead of attempting
  a merge that Gitea will reject.
- Add add_hold_label() function and case-insensitive auto-hold logic to
  MergePermissionError handler: when Gitea's merge gate returns 405 with
  "Not all required status checks", the PR is auto-held and the queue
  moves to the next PR.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/scripts/gitea-merge-queue.py

@@ -44,7 +44,10 @@ REQUIRED_CONTEXTS_RAW = _env(
     "REQUIRED_CONTEXTS",
     default=(
         "CI / all-required (pull_request),"
-        "sop-checklist / all-items-acked (pull_request)"
+        "sop-checklist / all-items-acked (pull_request),"
+        "E2E Chat / E2E Chat (pull_request),"
+        "qa-review / approved (pull_request),"
+        "security-review / approved (pull_request)"
     ),
 )
 # Required contexts for push (main/staging) runs. The push CI uses the same
@@ -348,6 +351,28 @@ def post_comment(pr_number: int, body: str, *, dry_run: bool) -> None:
     api("POST", f"/repos/{OWNER}/{NAME}/issues/{pr_number}/comments", body={"body": body})
 
 
+def add_hold_label(pr_number: int, *, dry_run: bool) -> None:
+    """Add HOLD_LABEL to a PR if not already present."""
+    if not HOLD_LABEL:
+        return
+    # Check current labels first to avoid a no-op API call in dry-run.
+    _, current = api("GET", f"/repos/{OWNER}/{NAME}/issues/{pr_number}/labels")
+    current_names = {l["name"] for l in (current if isinstance(current, list) else [])}
+    if HOLD_LABEL in current_names:
+        print(f"::notice::PR #{pr_number} already has hold label; skipping add")
+        return
+    print(f"::notice::PR #{pr_number} adding hold label `{HOLD_LABEL}`")
+    if dry_run:
+        return
+    new_labels = list(current_names) + [HOLD_LABEL]
+    api(
+        "PATCH",
+        f"/repos/{OWNER}/{NAME}/issues/{pr_number}",
+        body={"labels": new_labels},
+        expect_json=False,
+    )
+
+
 def update_pull(pr_number: int, *, dry_run: bool) -> None:
     print(f"::notice::updating PR #{pr_number} with base branch via style={UPDATE_STYLE}")
     if dry_run:
@@ -455,10 +480,29 @@ def process_once(*, dry_run: bool = False) -> int:
         try:
             merge_pull(pr_number, dry_run=dry_run)
         except MergePermissionError as exc:
-            # Permanent merge failure (HTTP 403/404/405). Post a comment so
-            # maintainers know why, then return 0 so this tick is done.
-            # The PR stays in the queue; future ticks can retry after the
-            # permission issue is resolved.
+            # HTTP 403/404/405. Distinguish status-check gate (405 with
+            # "Not all required status checks") from a genuine permission
+            # error. Case-insensitive match — Gitea uses "Not all required..."
+            # (capital N) while other paths may return lowercase.
+            msg_lower = str(exc).lower()
+            is_status_check_failure = "not all required status checks successful" in msg_lower
+            if is_status_check_failure:
+                # Gitea's merge gate blocked us — a required context (e.g.
+                # E2E Chat, qa-review, security-review) is failing. Auto-add
+                # hold so the queue skips this PR and processes the next.
+                add_hold_label(pr_number, dry_run=dry_run)
+                post_comment(
+                    pr_number,
+                    (
+                        "merge-queue: merge blocked by Gitea's status-check gate "
+                        "(E2E Chat, qa-review, security-review, or other required "
+                        "context failing). Auto-held via `merge-queue-hold`. "
+                        "Remove the hold label to requeue once CI is green."
+                    ),
+                    dry_run=dry_run,
+                )
+                return 0
+            # Genuine permission error — token lacks Can-merge.
             sys.stderr.write(f"::error::merge permission error for PR #{pr_number}: {exc}\n")
             post_comment(
                 pr_number,

.gitea/workflows/qa-review.yml

@@ -89,6 +89,7 @@ on:
 permissions:
   contents: read
   pull-requests: read
+  secrets: read  # required for SOP_TIER_CHECK_TOKEN team-membership probe (internal#325)
 
 jobs:
   # bp-exempt: PR review bot signal; required merge state is enforced by CI / all-required.

.gitea/workflows/security-review.yml

@@ -16,6 +16,7 @@ on:
 permissions:
   contents: read
   pull-requests: read
+  secrets: read  # required for SOP_TIER_CHECK_TOKEN team-membership probe (internal#325)
 
 jobs:
   # bp-exempt: PR security review bot signal; required merge state is enforced by CI / all-required.