🤖 Generated by the Agentic Engineer
Body repaired 2026-09-05. The original body was the literal string @/tmp/agent-plugins-stale-checks-issue.md — a --body "@path" invocation posted the path instead of the file — so this issue carried no content for five weeks. Rewritten from the title and the repository's own history.
Evidence
ci.yaml has gained two publication gates since this repository's PR traffic began, each a job the aggregated CI - Required Checks gate depends on:
A pull-request workflow runs only on that PR's own pull_request events. Every PR already open when a gate lands therefore keeps the green CI - Required Checks result it earned before the gate existed; nothing re-evaluates it, and the branch-protection rule keyed on that check name is satisfied by the stale run. Such a PR can merge without the new gate ever having run against it — which is exactly the class of change (a version left unbumped, a synced skill hand-edited) the gate was added to stop.
Related but distinct, measured 2026-09-05: a PR opened in this repository (#194) received no pull_request run at all until it was closed and reopened. That is event delivery, not gate staleness, but it is the same blind spot — a PR whose green predates, or never included, the checks main requires.
Affected audience and impact
Every PR open at the moment a required gate is added — the daily deps/agent-skills-update PR most often, since it is open nearly every day. The impact is a merge that bypasses a gate main declares required, with no signal.
Expected behaviour
When a change to main adds or alters a required CI gate, every open PR is re-evaluated against it before it can merge — either by re-triggering each open PR's checks (an update-branch where the PR is behind, a dispatch of the CI workflow against the PR's head where it is not) from a workflow that runs on pushes to main touching .github/workflows/ci.yaml, or by making the required check's identity change whenever its job set changes, so a stale green no longer satisfies the rule.
Acceptance criteria
Rough size: S–M — one workflow (or one ruleset change) plus a test.
Evidence
ci.yamlhas gained two publication gates since this repository's PR traffic began, each a job the aggregatedCI - Required Checksgate depends on:check-version-bump— 2026-07-26 (fix(agentic-engineering): make plugin content changes reach consumers #100): a plugin whose shipped content changed must move its version, or consumers never receive it.check-bundled-skill-edits— 2026-08-22 (security(skills): refuse a hand-edit to a bundled skill tree, and name its upstream #155): a hand edit inside a synced skill tree is refused and its upstream named.A pull-request workflow runs only on that PR's own
pull_requestevents. Every PR already open when a gate lands therefore keeps the greenCI - Required Checksresult it earned before the gate existed; nothing re-evaluates it, and the branch-protection rule keyed on that check name is satisfied by the stale run. Such a PR can merge without the new gate ever having run against it — which is exactly the class of change (a version left unbumped, a synced skill hand-edited) the gate was added to stop.Related but distinct, measured 2026-09-05: a PR opened in this repository (#194) received no
pull_requestrun at all until it was closed and reopened. That is event delivery, not gate staleness, but it is the same blind spot — a PR whose green predates, or never included, the checksmainrequires.Affected audience and impact
Every PR open at the moment a required gate is added — the daily
deps/agent-skills-updatePR most often, since it is open nearly every day. The impact is a merge that bypasses a gatemaindeclares required, with no signal.Expected behaviour
When a change to
mainadds or alters a required CI gate, every open PR is re-evaluated against it before it can merge — either by re-triggering each open PR's checks (an update-branch where the PR is behind, a dispatch of the CI workflow against the PR's head where it is not) from a workflow that runs on pushes tomaintouching.github/workflows/ci.yaml, or by making the required check's identity change whenever its job set changes, so a stale green no longer satisfies the rule.Acceptance criteria
mainthat changes.github/workflows/ci.yaml, every open PR's required check is re-run at the PR's current head without a manual push.AGENTS.mdbeside the description of the two gates, so a future gate addition is recognised as the moment this applies.Rough size: S–M — one workflow (or one ruleset change) plus a test.