governance: required check 'In-repo packages resolve from source' is path-filtered — every PR is permanently BLOCKED unless it touches a package.json

[izzywdev]

The deadlock

The Protect Master ruleset requires the context In-repo packages resolve from source. That context is produced by .github/workflows/workspace-deps-check.yml, which is path-filtered:

on:
  pull_request:
    paths:
      - '**/package.json'
      - 'scripts/check-workspace-deps.mjs'
      - '.github/workflows/workspace-deps-check.yml'

A required check that never runs never reports, and GitHub treats a missing required context as not satisfied. So any PR that does not touch a package.json is BLOCKED forever, no matter how green it is.

Verified on #284: every other required check passed —
gate-lint, gate-test, gate-build, gate-frontend-build, gate-ds-conformance, gate-sast, gate-secret-scan, gate-dependency-scan, Security Scan — while In-repo packages resolve from source was MISSING, leaving mergeStateStatus: BLOCKED.

Why it matters

This is the reason every merge in this repo needs --admin, and it quietly defeats the automation CLAUDE.md promises:

"All four agent-branch prefixes trigger an automatic non-draft PR with the auto-merge label… the branch self-resolves once all CI gates pass — no human required."

It cannot self-resolve. auto-merge waits on a context that will never arrive. Combined with the sibling bug (claude-auto-pr can't create PRs at all — Actions lack permission), the agent-branch → auto-PR → auto-merge path is fully non-functional, and every agent branch needs a human with admin.

It also trains everyone to reach for --admin, which bypasses all the required checks — including the ones that would have caught something real. That is the actual risk here: the deadlock doesn't just block merges, it erodes the gate.

Fix (pick one)

1. Always run, skip the work (preferred — keeps the gate honest): drop the paths: filter and make the job short-circuit internally when no package.json changed. The context always reports, so it can be required.
2. Path-filter shim job: add a companion job with the same name that runs on the inverse path set and exits 0 — the standard GitHub workaround.
3. Remove it from required contexts in the ruleset (weakest — loses the guarantee).

(1) is the right shape: a required gate should be a gate, not a coin flip on which files you touched.

Related

• claude-auto-pr.yml cannot create PRs (GitHub Actions is not permitted to create or approve pull requests) — separate, same effect.
• gate-code-review mostly reports "Credit balance is too low" — when it does run it earns its keep (it caught two real bugs in feat(security): email verification during registration #275).
• The auth e2e (Playwright sign-in flow, OIDC plumbing) are not required — which is how a broken security path stayed red for days.

Found while merging #282/#284, both of which were green and still unmergeable without admin.