fix(noema): skip workflow_run without PR context

[seonghobae]

Summary

• keep Noema fail-closed behavior when token exchange is configured but OIDC/app-token exchange fails
• skip Noema review with an explicit warning when the organization has not configured NOEMA_TOKEN_EXCHANGE_URL/NOEMA_EXCHANGE_URL, which matches the current live org state
• skip workflow_run triggers that do not carry a pull request number, preventing post-merge main workflow_run events from trying token exchange with empty PR context
• add workflow contract tests for both guards

Evidence

• Failure read: Required Noema Review run 29132364498 failed on merge commit ac127b7 because TOKEN_EXCHANGE_URL and PR_NUMBER were empty on a workflow_run-triggered main event.
• Failure read: PR fix(noema): skip workflow_run without PR context #436 initial run 29132551707 failed because PR_NUMBER=436 but TOKEN_EXCHANGE_URL was empty; org/repo NOEMA variables and secrets are not configured.
• CodeGraph: synced and explored noema-review workflow_run PR guard plus token exchange disabled/fail-closed contract tests.
• python3 -m pytest -q tests/test_required_workflow_queue_contract.py tests/test_noema_review_gate.py: 35 passed
• python3 -m pytest -q: 283 passed
• python3 -m py_compile scripts/ci/noema_review_gate.py scripts/ci/pr_review_merge_scheduler.py: passed
• git diff --check: passed

[seonghobae]

Superseded by #435, which already landed the trusted-main Noema workflow_run PR-context guard and unconfigured-token-exchange skip behavior. I rechecked current main at 6f8b007: Required Noema Review is passing, code scanning has no new real vulnerability alerts beyond the existing Scorecard governance findings, and this branch now conflicts while reverting the stronger #435 guards.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 9af079ca49a2d47f3e8472a67618f8db9be12e8a
• Workflow run: 29132643023
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.

Findings

1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch

• Problem: GitHub reports mergeStateStatus DIRTY for this pull request.
• Root cause: Branch fix/noema-skip-non-pr cannot be merged cleanly into main; the changed-file flow below shows which review/runtime path is blocked by the conflict.
• Fix: Merge or rebase the latest main into fix/noema-skip-non-pr, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch.
• Repair commands:

gh pr checkout 436 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/noema-skip-non-pr
# rebase path only: git push --force-with-lease origin HEAD:fix/noema-skip-non-pr

• Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.

Merge Conflict Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: noema-review.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_required_workflow_queue_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["targeted test run"]

Loading

• Result: REQUEST_CHANGES
• Reason: mergeStateStatus is DIRTY; mergeable is CONFLICTING.
• Head SHA: 9af079ca49a2d47f3e8472a67618f8db9be12e8a
• Workflow run: 29132643023
• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: noema-review.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_required_workflow_queue_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["targeted test run"]

Loading

Merge Conflict Guidance

• Current merge state: DIRTY
• Base branch: main
• Head branch: fix/noema-skip-non-pr
• Fix direction: merge or rebase origin/main into fix/noema-skip-non-pr, resolve conflict markers in the changed files, rerun the focused checks, then push the same branch.
• Repair commands:

gh pr checkout 436 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/noema-skip-non-pr
# rebase path only: git push --force-with-lease origin HEAD:fix/noema-skip-non-pr

[github-actions]

Pull request overview

OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.

Findings

1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch

• Problem: GitHub reports mergeStateStatus DIRTY for this pull request.
• Root cause: Branch fix/noema-skip-non-pr cannot be merged cleanly into main; the changed-file flow below shows which review/runtime path is blocked by the conflict.
• Fix: Merge or rebase the latest main into fix/noema-skip-non-pr, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch.
• Repair commands:

gh pr checkout 436 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/noema-skip-non-pr
# rebase path only: git push --force-with-lease origin HEAD:fix/noema-skip-non-pr

• Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.

Merge Conflict Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: noema-review.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_required_workflow_queue_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["targeted test run"]

Loading

• Result: REQUEST_CHANGES
• Reason: mergeStateStatus is DIRTY; mergeable is CONFLICTING.
• Head SHA: 9af079ca49a2d47f3e8472a67618f8db9be12e8a
• Workflow run: 29132643023
• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: noema-review.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_required_workflow_queue_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["targeted test run"]

Loading