ci: never skip stale-base-overlap-gate on push

[kyle-sexton]

No linked issue

Summary

Every push to main since #2799 has failed the required ci-status check because stale-base-overlap-gate skipped on non-PR events and the aggregator rejects any needs.*.result other than success.

Fix

Remove the job-level if: github.event_name == 'pull_request'. The detector self-test now runs on every event (including push to main). Fetch-base and the overlap check stay PR-only. Checkout uses github.event.pull_request.head.sha || github.sha so ref is never empty on push. The aggregator is unchanged: skipped required lanes stay fail-closed.

Verification

• bash scripts/check-stale-base-overlap.test.sh: ALL PASS (usage, fresh base, overlapping behind-base fails, disjoint behind-base, missing ref).
• This PR's stale-base-overlap-gate ran (not skipped) and passed; ci-status passed.
• After merge, a main push should report stale-base-overlap-gate as success (self-test only) so ci-status can go green.

Related

Refs #2691 (the stale-base gate this job implements). The skip-on-push failure is the same never-skip contract documented on plugin-gate / skill-quality-gate / hygiene.

  

[claude]

Claude finished @kyle-sexton's task in 1m 0s —— View job

---

Security review

• Gather context (PR diff, workflow file)
• Apply skip-gate check
• Review changed workflow logic for security-relevant issues
• Post findings

No security issues found.

This PR only touches .github/workflows/ci.yml, changing the stale-base-overlap-gate job's conditional structure (lines 687–712):

• Job-level if: github.event_name == 'pull_request' is removed so the job always runs (required for the ci-status aggregator to see success rather than a fail-closed skip).
• The two PR-only steps (Fetch base ref, Fail when behind base on overlapping paths) each gain their own if: github.event_name == 'pull_request', preserving prior behavior for those steps.
• The checkout ref now falls back to github.sha on push (${{ github.event.pull_request.head.sha || github.sha }}), used only in the actions/checkout with: block — not interpolated into a run: shell string, so there's no script-injection surface here.

Checked for the usual risk patterns and found none introduced:

• permissions: contents: read at the workflow top level is unchanged; the job has no elevated job-level permissions:.
• actions/checkout remains pinned by full commit SHA with persist-credentials: false.
• BASE_REF (from github.base_ref) is still passed through an env: indirection rather than templated directly into the run: script — the safe pattern for untrusted-context values — and this PR doesn't change that.
• Trigger scope is unchanged (push: branches: [main], pull_request); no new triggers, no pull_request_target/workflow_run introduced.
• No secrets are read or used anywhere in this job.

This is a narrowly-scoped CI reliability fix with no security-relevant behavior change.

[github-actions]

Last security-reviewed head: aa7d239cc03ea49fa4496a4d29aa175af97c52d7. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 23s —— View job

---

Code review (/review:code-review)

• Gather context (PR diff, workflow file)
• Apply skip gate
• Post findings

Skip gate: PR is not open (state = MERGED). Per the skip-gate rule in /review:code-review, no deep review is performed and no findings are posted for a closed/merged PR.

For reference, a security review of this same head SHA (aa7d239cc03ea49fa4496a4d29aa175af97c52d7) was already posted above and found no issues in the .github/workflows/ci.yml change.

[claude]

Claude finished @kyle-sexton's task in 35s —— View job

---

Todo List

• Gather context (PR diff, workflow file)
• Run /review:security-review skill per custom instructions
• Apply skip gate check
• Post findings

Security review

Skipped — nothing to report.

The /review:security-review skip gate applies here on two independent grounds:

1. PR is not open — this PR is MERGED, not open.
2. This head already has a successful security review that still applies — head SHA aa7d239cc03ea49fa4496a4d29aa175af97c52d7 was already reviewed in this thread (see the earlier "No security issues found" comment), and the tracking comment confirms aa7d239cc03ea49fa4496a4d29aa175af97c52d7 is the last security-reviewed head with no new commits since.

Per the skill's skip-gate instructions, no further review output is produced.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.