[jayleaton]

Rules. Before merge, run what this change needs on its exact head (docs/CI.md, "What to run"): for Go, make lint test scoped with LINT_DIRS/TEST_PKGS (scripts/affected.sh prints them) or make check-fast, plus the checks of what you touched. Then make ci-local RAN="<what you ran>" posts local-ci and fills "Local verification" with that statement and the head SHA. Never edit that section by hand. The Local verification check, make pr-merge and the staging gate refuse the PR while it is missing, names another head, or differs from what local-ci attested. A new push or rebase needs a new attestation. A reported failure (FAILED=) is final for that head: fix it in a new commit (docs/CI.md, "Local verification").

Problem

On a repository whose Actions are blocked by billing, GitHub creates each CI run but fails Secret scan and Local verification claim without starting them, and skips the checking job for want of its needs. make pr-merge dropped the never-started jobs, then missed the Local verification gate and reported skip - has checks still running: Local verification. So local-ci alone could never merge there (seen on jayleaton/sparkrack#17).

Fix

verify.ClassifyChecks: a CI run with any job GitHub never started counts as not run as a whole, so its skipped checking job no longer holds the merge. A newer run that did run still counts. Two test cases cover it: sparkrack #17's exact rollup, and a newer failed run after a blocked one.

This came after #134 merged at 34e7ffe; it was a619b40 on that branch.

Evidence

• On this tree (identical to a619b40's, git rev-parse <commit>^{tree}), in a Davit box with stale image files pruned:
  • go test -count=1 -cover ./scripts/cilocal/verify: 100.0%.
  • go vet ./scripts/cilocal/... and make lint LINT_DIRS=./scripts/cilocal/...: 0 issues.
• Before the fix, against sparkrack fix(auth): cheap argon2 in test binaries so -race suites stay small #17's live rollup: skip - has checks still running: Local verification. After the same fix on sparkrack's branch: see fix(auth): cheap argon2 in test binaries so -race suites stay small #17.

Merge Danger

Door: two-way.

Blast Radius: make pr-merge only. It now merges on local-ci alone where a whole CI run was blocked by billing; --require-actions still refuses.

🤖 Generated with Claude Code

Local verification

Filled by make ci-local, 2026-10-31T12:17:20Z. Never edit this section by hand.

Head 42b7c496d37775d66a7cc114e3fc0f3297b922bd · tree 67581baf15ae · passed
Attested by JJ Eaton on MacBook-Pro-3.local

Ran: This tree (identical to a619b40's), in a Davit box with stale image files pruned: go test -count=1 -cover ./scripts/cilocal/verify (100.0%), go vet ./scripts/cilocal/..., make lint LINT_DIRS=./scripts/cilocal/... (0 issues). The rest of the tree is main ad7b6b1 (#134 at 34e7ffe, attested after make ci)

[jayleaton]

Authorized by JJ ("please also merge the PRs on my template"), merged by Captain with --admin after make ci-local attested head 42b7c496d37775d66a7cc114e3fc0f3297b922bd (local-ci success).