CI Failure Analyst never runs for failed GitHub Actions jobs: the check_run trigger only fires for third-party checks #2235

Problem

CI Failure Analyst is documented as diagnosing failed CI, Lint and Test runs. In practice it never runs for a failed GitHub Actions job, in any repo, on any release. It only runs when a third-party app's check fails.

The standard stub (templates/ci-failure-analyst.yml) triggers on check_run: [completed], and the reusable reads only github.event.check_run.*. GitHub does not start a workflow for an event raised by GitHub Actions' own token, so a check run created by an Actions job never delivers a check_run event to the stub. Check runs from other apps (SonarCloud, for example) do.

Evidence (2026-10-10)

• .github-private: more than 50 failed workflow runs today; of the analyst's last 300 runs, 300 were skipped or empty and none ran the analysis.
• google-app-scripts: its only two successful analyst runs (37562808488, 36585887034) were both triggered by a SonarCloud check (DETAILS_URL: https://sonarcloud.io/...). A failed Actions job on 2026-10-09 (ideate / Gather Project Signals) produced no analyst run.
• TalkTerm: 8 successful runs in its last 300, the latest on 2026-09-07.
• bmad-bgreat-suite: still carries the older stub that triggers on workflow_run, which does fire for Actions failures. The reusable cannot read that payload, so every such run fails with jq: error: Cannot iterate over null (run 38052385125). [Fleet Monitor] petry-projects/bmad-bgreat-suite — .github/workflows/ci-failure-analyst.yml bmad-bgreat-suite#479 moves that stub to check_run so it stops failing; that does not give it Actions coverage either.
• CodeAnt and CodeRabbit both raised this on petry-projects/bmad-bgreat-suite PR 499.

Decision (maintainer, 2026-10-11): option 1

The analyst learns about failed GitHub Actions runs through a workflow_run trigger. The check_run trigger stays, so failed third-party checks (SonarCloud and the like) keep working. Options 2 and 3 are not being pursued.

Delivery order (maintainer, 2026-10-14)

This lands in two PRs. Every stub, including this repo's own caller, pins ci-failure-analyst/v1-stable, and the reusable on that channel (v1.0.0) fails on a workflow_run payload. The trigger can only be added after the channel carries the new reusable.

1. PR feat: implement issue #2235 — CI Failure Analyst never runs for failed GitHub Actions jobs: the check_run trigger only fires for third-party checks #2308 "feat: implement issue CI Failure Analyst never runs for failed GitHub Actions jobs: the check_run trigger only fires for third-party checks #2235" — the reusable accepts either event. Criteria 1 and 3, and the docs half of criterion 4. It references this issue and does not close it.
2. A second PR, after ci-failure-analyst/v1-stable has been promoted to a release containing PR feat: implement issue #2235 — CI Failure Analyst never runs for failed GitHub Actions jobs: the check_run trigger only fires for third-party checks #2308. Criterion 2 (the workflow_run trigger in templates/ci-failure-analyst.yml, in .github/workflows/ci-failure-analyst.md and in its lock file, with the caller-stub-freeze baseline and the interaction contract updated to match) and the live proof in criterion 4. That PR closes this issue.

Acceptance criteria

1. The reusable accepts either event. .github/workflows/ci-failure-analyst-reusable.yml resolves the head SHA, the non-fork PR, and the failing job, step and log from whichever payload it was called with:
   • check_run: unchanged behaviour.
   • workflow_run: head SHA from github.event.workflow_run.head_sha; PR from workflow_run.pull_requests (non-fork only), falling back to the commit-to-pulls lookup the step already has; failing jobs and their logs from the run id.
   • A payload that carries neither (or a run with no associated non-fork PR) ends in the existing "skipping" notice with exit 0. It must never reach jq: Cannot iterate over null.
   • Move the payload resolution into a script under scripts/ so it can be tested, and add bats cases for a check_run payload, a workflow_run payload, a workflow_run on the default branch with no PR, and an empty payload.
2. The stub triggers on both events. templates/ci-failure-analyst.yml and this repo's own caller (.github/workflows/ci-failure-analyst.md and its compiled lock file) gain a workflow_run: types: [completed] trigger next to check_run:
   • the workflows: list names the workflows to watch (GitHub requires names; there is no wildcard) and the header says each repo may edit that list;
   • the job if: passes a failed check_run or a failed workflow_run, and still excludes the analyst's own runs;
   • the concurrency group uses the head SHA from whichever event fired.
3. One analysis per commit, not one per trigger. The existing per-SHA idempotency marker (<!-- ci-analyst sha=... -->) still prevents a second comment when several workflows fail on the same commit, and a test covers two failures on one SHA.
4. Docs and live proof. docs/aw/ci-failure-analyst.md states which failures the analyst covers and how to edit the watched-workflow list. After the change is on a channel this repo runs, a failed Actions job on a PR in .github-private produces one analyst comment; link it here before closing.

Notes for the implementer

• The change is inert until a channel is cut. Say so in the PR description.
• Do not edit consumer repos' stubs from this issue. They are re-seeded through the normal standards deployment once the template has changed.
• bmad-bgreat-suite was moved to the check_run stub by its PR 499; it picks up the new trigger with everyone else.

Related

• ci-failure-analyst can never reach stable: its ring1 members pin v1-stable, so the ring1->stable gate has no sample to count (stable frozen on v1.0.0 since 2026-07-10) .github#1270 (ci-failure-analyst/v1-stable frozen on v1.0.0). Consumers pinned to stable will not see this change until that promotes.
• markets ingress pins ci-failure-analyst by bare commit SHA (DEFECTIVE PIN): move it to a channel once stable is no longer frozen #2176 (markets pins the reusable by bare SHA).