The gate-check job now checks out github.event.pull_request.head.sha
instead of base.sha. This ensures that script fixes in PR branches
(e.g. the self-loop exclusion in signal_6_ci) are actually used when
evaluating that PR.
Security note: this job only runs the read-only gate-check script
(API reads + JSON stdout) and has continue-on-error: true, so
running PR-branch code here carries minimal risk.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Bug 1 (self-referential failure loop, #544):
signal_6_ci now filters out its own prior status from
check_statuses before evaluating, preventing a
gate-check-v3 → failure → re-reads self → failure cycle.
Bug 2 (hardcoded base branch, #544):
signal_6_ci now uses the PR's actual base branch ref
instead of hardcoded 'main'. Caller passes PR data to
avoid redundant API call.
Bug 3 (comment-post 403, #543):
Wrapped POST/PATCH comment-post in try/except for
HTTPError 403. Logs a warning and skips posting when
the token lacks write:repository scope — verdict still
drives exit code correctly.
Also removed 3 lines of dead code at the end of
format_comment (unreachable return after prior return).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
