From 78bb43d55091b11d7b991bdfc8635e33fade49f2 Mon Sep 17 00:00:00 2001
From: Imants <imants.kokis@gmail.com>
Date: Tue, 1 Sep 2026 15:35:00 +0300
Subject: [PATCH] ci: keep release-gate job green and fix skipped-check
 aggregation

The release-gate job only posts the Release Checklist commit status; the
verdict belongs in that status, not the job's exit code. Exiting non-zero on a
failure verdict turned the reporter workflows red and duplicated the status, so
the failure branches now exit 0 again. Branch protection should require the
Release Checklist status.

A summary check can appear more than once on a head SHA (a skipped run from one
event plus the real run from another); the old 'last' aggregation could pick the
skipped duplicate and report a passing release as failing. state_of now prefers
the latest non-skipped run per check name.
---
 .github/actions/release-gate/action.yml | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/.github/actions/release-gate/action.yml b/.github/actions/release-gate/action.yml
index 0c75da5b6..5977dcb65 100644
--- a/.github/actions/release-gate/action.yml
+++ b/.github/actions/release-gate/action.yml
@@ -39,14 +39,19 @@ runs:
         # there is nothing to gate on, so flag it rather than silently passing.
         if ! [[ " $PR_LABELS " == *" run-tests "* ]]; then
           post failure "Add the run-tests label so the test suites run."
-          exit 1
+          exit 0
         fi
 
-        # Latest conclusion of each required summary check for the head commit.
+        # Conclusion of each required summary check for the head commit. A name
+        # can appear more than once on a SHA (e.g. a skipped run from one event
+        # plus a real run from another), so prefer the latest NON-skipped run and
+        # only fall back to a skipped one when that is all there is.
         runs_json=$(gh api "repos/$REPO/commits/$HEAD_SHA/check-runs" --paginate 2>/dev/null || echo '{}')
         state_of() {
-          printf '%s' "$runs_json" | jq -r --arg n "$1" \
-            '[.check_runs[] | select(.name == $n)] | last // {} | "\(.status // "missing")|\(.conclusion // "")"'
+          printf '%s' "$runs_json" | jq -r --arg n "$1" '
+            ([.check_runs[] | select(.name == $n)] | sort_by(.completed_at // "")) as $all
+            | (($all | map(select(.conclusion != "skipped")) | last) // ($all | last) // {})
+            | "\(.status // "missing")|\(.conclusion // "")"'
         }
         pending=false; failed=false
         for name in "stylelint, eslint, phpcs" "PHPUnit - Test Results Summary" "Playwright - Test Results Summary"; do
@@ -65,13 +70,13 @@ runs:
 
         if [ "$failed" = true ]; then
           post failure "Required CI checks are not all passing."
-          exit 1
+          exit 0
         fi
 
         # All required checks are green. Validate the release PR itself.
         case "$BASE_REF" in
           core|core-beta|pro|pro-beta) ;;
-          *) post failure "Base branch '$BASE_REF' must be core, core-beta, pro or pro-beta."; exit 1 ;;
+          *) post failure "Base branch '$BASE_REF' must be core, core-beta, pro or pro-beta."; exit 0 ;;
         esac
 
         # Parse the two "Release verification" checkboxes, fence-aware so text
@@ -90,7 +95,7 @@ runs:
 
         if [ "$total" -ne 2 ] || [ "$checked" -ne 2 ]; then
           post failure "Tick both release-verification checkboxes ($checked/$total approved)."
-          exit 1
+          exit 0
         fi
 
         post success "Required checks green and release verification approved."