feat(gate): agent 分支 PR 须 agent-approved label 才放行——draft 口头约定升级为机制

[2233admin]

干什么

pr-gate.yml 新增 agent-gate job:head 分支匹配 grok/** / agent/** / codex/** 的 PR,必须带 agent-approved label(人点的)检查才绿;非 agent 分支直接通过。label 已建(agent-approved,绿色)。

为什么

#174 试点(PR #187)确认:本仓合并惯例是「绿灯即合」,而 agent PR 不误合的唯一防线是「记得开 draft」——口头约定,零机制。编排放量后这是必然事故点。本 job 把人审动作物化成 label,配合 branch protection required check(本 PR 合并后由维护者启用)形成真闸。

配套(合并后一步)

branch protection on main:required checks = change-risk + agent-gate + ci.yml 四个 job,enforce_admins 开。ci.yml pull_request 无 path 过滤,所有 PR 都会产生这些 check,不会有 docs-only PR 卡死问题。

验证

• 语法:actionlint 风格与现有 change-risk job 一致,复用同一触发集(labeled/unlabeled 已在,点 label 即重跑)。
• 行为验证在本 PR 无法自证(本分支非 agent 前缀,gate 走 not-applicable 分支);feat(devex): changelog.d 碎片化——终结 [Unreleased] 单行道冲突税 (#174) #187(grok/** 分支)将是第一个真实用例:未打 label 应红,打上应绿。

Refs #184

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[repowise-bot]

🔒 Repowise is not analyzing this repository

The PR bot is free on public repositories. This one is private, which needs a Pro plan.

See plans · Manage this repository

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 941cacb5-6547-4560-8632-2a68122e6154

📥 Commits

Reviewing files that changed from the base of the PR and between 9f21592 and c37fb30.

📒 Files selected for processing (1)

• .github/workflows/pr-gate.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated pull request validation for automated development branches.
  • Pull requests from designated agent branches now require an agent-approved label to pass checks.
  • Pull requests from other branches continue through validation without this additional requirement.

Walkthrough

The pull request workflow adds an agent-gate job. It requires the agent-approved label for pull requests from grok/*, agent/*, or codex/* branches. Other branches skip this check.

Changes

Agent branch gating

Layer / File(s)	Summary
Agent approval workflow check .github/workflows/pr-gate.yml	The agent-gate job skips non-agent branches, checks pull request labels for agent-approved, and fails agent branches when the label is absent.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks the branch at night,
“agent-approved” must shine bright.
Agent paths wait; other paths go,
Labels make the workflow flow.
Hop, hop, the gate says yes!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the new agent branch label gate and identifies the required agent-approved label.
Description check	✅ Passed	The description explains the agent-gate behavior, purpose, trigger events, verification limits, and planned branch protection configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code Intel change risk

Score	Percentile	Level
12/100	4th (vs last 49 commits)	🟢 low

Top signals

• Diff shape: 1 file(s), +30/-0 (max file share 1.0)
• Test asymmetry: source changed, tests touched
• Bug-magnet: 0 fix commit(s) in touched files (180d)
• Churn: 1 commit(s) touching these files (90d)

_{revspec: origin/main..HEAD · threshold: percentile >= 90 blocks unless labeled risk-accepted · code-intel change risk}