Run pull request validation for organization fallback changes #11

Describe the bug

Organization-fallback pull requests receive no hosted validation result. MSXOrg/.github#8 reports zero check runs and zero commit statuses, although the verified readiness contract does not treat absent checks as passing. A contributor cannot truthfully mark the fallback change ready using local checks alone.

Expected behavior: every applicable source pull request to main publishes a named, complete validation result at its actual head. Changed Markdown cannot bypass shared rules, retargeting to main is covered, intentional PR-template absence/deletion is valid, and empty or unsupported-only input is not a pass. Canonical PR-format guidance governs authored records separately from file presence.

Regression status: the last working hosted validation configuration is unknown. Workaround: keep affected delivery PRs draft; local lint and structural checks provide development evidence but are not a substitute for the missing gate.

Environment

Public MSXOrg/.github, target main, pull request head d066ecb2908362d7e6e7e6023f215279d76f5997, inspected on 2026-10-31. The checkout contains no .github/workflows directory or repository validation scripts. The Actions API lists only the dynamic Copilot and Dependabot workflows. The inherited organization ruleset 19735160 also names no required status checks; enforcing a selected validation check is a separate governance action, not permission for this delivery PR to mutate a ruleset.

Steps to reproduce

Run these read-only commands:

gh api repos/MSXOrg/.github/commits/d066ecb2908362d7e6e7e6023f215279d76f5997/check-runs --jq '{total_count, check_runs}'
gh api repos/MSXOrg/.github/commits/d066ecb2908362d7e6e7e6023f215279d76f5997/status --jq '{state, total_count, statuses}'
gh api repos/MSXOrg/.github/actions/workflows --jq '[.workflows[] | {name, path}]'
gh api repos/MSXOrg/.github/rules/branches/main --jq '[.[] | {type, parameters}]'

Relevant details

This issue originally captured the no-existing-CI finding. The explicit follow-up assignments authorize only its bounded workflow/code correction in #12, including current-review defects and the user-selected no-template contract. Live required-check, ruleset, and access changes remain separately unapproved; no CI rollout belongs in #8. The owning readiness requirement is the Definition of Ready for Review item requiring completed required checks and explicitly stating that a PR reporting no checks has not met the gate. An owner must approve separately scoped corrective work; local source/scaffold checks must not be reported as nonexistent hosted checks.

Verified cause boundary: this checkout has no PR validation workflow, and GitHub reports no validation checks for the live PR head. No failed runner, dependency, or trigger-filter diagnosis is asserted beyond that evidence.

Keep the correction limited to one reviewable validation-workflow PR using existing MSX Markdown and immutable configuration sources. The user-selected no-template contract supersedes scaffold presence/parity checks; actual record quality remains a separate canonical PR Format review. Do not introduce release publication, a plugin marketplace, PSModule defaults, or unrelated repository scaffolding. Required-check enforcement must be handled through the approved governance path once the named check exists.

Acceptance criteria:

• An applicable pull request to main, including Markdown-only changes and an edited retarget to main, receives a named completed check at its actual head.
• Intentional PR-template absence is valid. Descriptions use canonical guidance only; validation does not require, copy, generate, or compare a repository template. The central deletion is delivered separately by PR authors use canonical guidance without repository templates #8.
• Every selected existing Markdown input is actually linted with the shared rules; inline disables/configuration and local ignores cannot hide malformed content. A malformed anonymous case fails before correction and passes after correction.
• Intentional deleted inputs are checked and reported as absent, not counted as linted content. Empty or unsupported-only scans still fail explicitly.
• Actual-head, clean-checkout, literal-path, source correspondence, containment, and relevant-file guards remain effective. No template or fixture self-test substitutes for a real changed-input scan.
• The check remains read-only, named Organization defaults validation, with no publication, label/tag mutation, consumer rollout, hooks, or live rule/access change. Required-check governance remains separately unapproved.

Technical decisions: use the approved immutable shared Markdown/configuration sources, literal stdin validation with noInlineConfig, explicit edited activity coverage, and source/head/containment guards. PR-format guidance is canonical authoring context, not a copied scaffold/runtime dependency. Preserve source-only scope, other community files, and the separately unapproved enforcement boundary.

Initial CI implementation plan (completed before the user-directed no-template revision):

• Define a failing malformed-fallback fixture and confirm the absence of a hosted check at the reproducing PR head.
• Add the smallest PR-triggered validation workflow and directly related local validation/documentation needed by its named check.
• Verify both malformed and valid cases and inspect a completed result attached to the actual PR head.
• Hand off the exact check name for required-check enforcement; record remaining governance blockers without bypassing them.

Supporting evidence

The check-runs API returns total_count: 0; the combined-status API returns state: pending, total_count: 0, and statuses: []. The local file inventory has no workflow or validation toolchain. Rules inspected for main include deletion, non-fast-forward, linear history, and pull-request rules, but no required_status_checks rule. This gap is not resolved by the fallback-format PR.

User-directed no-template revision

The central owner removes only .github/pull_request_template.md in #8; README/contribution authoring links are separate owner paths. The validator revision removes its owned copied scaffold fixture and presence/structure assumptions while preserving real Markdown, immutable shared-source, and head/containment checks. Original reproduction evidence above remains historical context, not a requirement to restore the removed template.

• Reproduce the reviewed changed-Markdown bypass and edited retarget gap with anonymous cases before changing code.
• Reproduce valid no-template and intentional-deletion inputs against the old source controller.
• Remove copied-template assumptions and fix the demonstrated gaps while retaining no-input failure and read-only scope.
• Reproduce and fix the current-review shared-linter flag and PowerShell wildcard-path defects.
• Reproduce and fix the native runner default test-directory failure; CI exercises the default rather than bypassing it.
• Inspect completed validation and the entire fresh review at the final PR head, then record the exact check/source and separately gated governance handoff.

Final current-review corrections also reproduce and fix case-only deletion and skipped-only summary/exit disagreement. All source/no-input guards remain in place; those case dispositions are recorded with exact commands and actual-head evidence in #12.