[teemow]

Problem

devctl pr merge is red (exit 1) on any failed check, and the gate passed that on: a check the base branch does not require, red on the base branch's head for a known reason, refused every unrelated pull request, a docs-only one included (#1048).

Change

The gate judges a red run against its base branch (merge.JudgeRed, the base read by github.ReadBaseChecks with gh api: the branch's protection and rulesets for the required contexts, its head's check runs and statuses):

• a red check that the base does not require, is no security scan (nancy, gitleaks, govulncheck, trivy, CodeQL, …) and is red on the base head too is let through;
• a red check green on the base head (the pull request broke it), still running there, or without a result there refuses, so nothing slips through on a missing comparison;
• a red required check, any red security scan and a red CircleCI workflow refuse as before.

When every red check is let through, devctl runs again with --accept-red <check> for each (event merge.acceptred, naming the check and why), and the caller reads that run's document alone. Otherwise the run ends red as before, and the gate's line names the judgement. The red document is held off stdout until it is judged.

--accept-red is giantswarm/devctl#2692. The gate checks for the flag in devctl pr merge --help. Until the installed devctl has it, the gate keeps today's behaviour, and its line says the merge waits for a devctl release with the flag.

Proof

• Table tests (internal/merge/red_test.go): non-required red on both heads (let through), non-required red on the PR only (refuse), required red (by the document or by the base's protection: refuse), security scan red on both heads (refuse), base result missing (refuse), base still running (refuse), a mix (refuse, naming both), a red CircleCI workflow (refuse).
• Gate tests (cmd/gateacceptred_test.go): a run red only on a base-red check is run again with --accept-red e2e-test and merges, and the caller reads one document. A check green or missing on the base, or a devctl without the flag, ends red after one run.
• internal/github/basechecks_test.go: required contexts from protection and rulesets; newest check run per name; statuses.
• Full suite green with go test -p 2 ./....
• Live, read-only: the branch code judged feat(credprovider): a provider bounds how long the injector reuses its answer substrate#110 (the only open pull request there, red on fork-ledger). It read the giantswarm branch's required contexts live (fork-ledger, govulncheck, run-tests, semantic-pull-request / Validate PR title) and refused (fork-ledger refuses: required by giantswarm). No open pull request had a non-required check red on both heads at the time, so the unit tests prove that case.

Acceptance criteria

• A pull request whose only red check is non-required and equally red on the base head goes through the gate, and the output names the check and why (once devctl has --accept-red).
• A red non-required check green on the base head still refuses.
• A red required check or security scan still refuses.
• Tests cover the cases.