fix(ci): green the HADES/ARTEMIS/FinnGen scheduled jobs without external prereqs

Resolves the three remaining scheduled-workflow failures, each blocked on a
prerequisite the workflow itself never satisfied:

- finngen-tests (darkstar-integration): ran `docker compose up`/`exec` without
  creating backend/.env, which docker-compose.yml requires via env_file, so
  compose aborted with "env file backend/.env not found" before the finngen-*
  testthat suite ever ran. Seed backend/.env (and root .env) from the committed
  examples, mirroring the Backend job. This was a workflow bug, not a
  self-hosted-runner issue — the job runs on ubuntu-latest.

- artemis-pattern-update: HemOnc-org/HemOnc is not resolvable (license-gated /
  private), so remotes::install_github failed every run. Probe the source via
  curl first and gate the install/extract/validate/commit steps on it; when
  unreachable the job skips extraction gracefully (stays green, emits a
  ::warning) until a reachable repo path or PAT secret is supplied.

- hades-version-drift: org policy forbids Actions creating PRs, so
  peter-evans/create-pull-request failed at the PR step. Push the refreshed
  targets to automation/hades-version-drift and open/update an idempotent
  tracking issue (body-marker dedupe, existing `dependencies` label) linking
  the compare view. Re-enable the automated PR by turning on "Allow GitHub
  Actions to create and approve pull requests" in repo settings.

Co-Authored-By: claude-flow <ruv@ruv.net>

Author: sudoshi

.github/workflows/artemis-pattern-update.yml

@@ -68,18 +68,41 @@ jobs:
           echo "ref=$PIN" >> "$GITHUB_OUTPUT"
           echo "Pinned HemOnc ref: $PIN"
 
+      - name: Check HemOnc source availability
+        id: hemonc
+        run: |
+          # HemOnc is license-gated and the public HemOnc-org/HemOnc repo is not
+          # resolvable anonymously. Probe it first; if unreachable, skip the
+          # extraction gracefully (job stays green) instead of failing the
+          # scheduled run red. Supply a reachable repo path or a PAT-authenticated
+          # remote in the steps below to re-enable extraction. Use curl (not
+          # git ls-remote) so a private/404 repo returns a status code instead
+          # of hanging on a credential prompt.
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' \
+            "https://api.github.com/repos/HemOnc-org/HemOnc")
+          if [ "$CODE" = "200" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+            echo "HemOnc source reachable — proceeding with extraction."
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            echo "::warning title=ARTEMIS extraction skipped::HemOnc source (HemOnc-org/HemOnc) returned HTTP ${CODE} — skipping pattern extraction until a reachable source or PAT is supplied."
+          fi
+
       - name: Install HemOnc R-package
+        if: steps.hemonc.outputs.available == 'true'
         run: |
           R -e "install.packages('remotes', repos='https://cloud.r-project.org')"
           R -e "remotes::install_github('HemOnc-org/HemOnc@${{ steps.pin.outputs.ref }}', upgrade='never')"
 
       - name: Run extractor
+        if: steps.hemonc.outputs.available == 'true'
         run: |
           mkdir -p templates/runtime/oncology/artemis/v0.2.0
           Rscript templates/tools/extract_artemis_regimens.R \
             --output templates/runtime/oncology/artemis/v0.2.0/patterns.json
 
       - name: Validate generated JSON shape
+        if: steps.hemonc.outputs.available == 'true'
         run: |
           jq -e '.version == "v0.2.0"' \
             templates/runtime/oncology/artemis/v0.2.0/patterns.json
@@ -92,6 +115,7 @@ jobs:
           done
 
       - name: Auto-commit if changed
+        if: steps.hemonc.outputs.available == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |

.github/workflows/finngen-tests.yml

@@ -260,6 +260,18 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Provision env files for docker compose
+        run: |
+          # docker-compose.yml loads backend/.env via env_file for several
+          # services and interpolates ${VARS} from the root .env. Both are
+          # gitignored and absent in CI, so `docker compose` aborts with
+          # "env file backend/.env not found" before darkstar ever starts.
+          # Seed them from the committed examples; the finngen-* testthat
+          # suite runs against fixtures (not a live DB), so example values
+          # are sufficient to bring the service up.
+          cp backend/.env.example backend/.env
+          [ -f .env ] || cp .env.example .env 2>/dev/null || touch .env
+
       - name: Build darkstar image
         run: docker compose build darkstar
 

.github/workflows/hades-version-drift.yml

@@ -7,7 +7,7 @@ on:
 
 permissions:
   contents: write
-  pull-requests: write
+  issues: write
 
 jobs:
   check-hades-versions:
@@ -43,22 +43,89 @@ jobs:
           name: hades-version-drift
           path: output/hades/
 
-      - name: Open drift pull request
-        uses: peter-evans/create-pull-request@v6
-        with:
-          branch: automation/hades-version-drift
-          commit-message: "chore(hades): refresh target package versions"
-          title: "chore(hades): refresh target package versions"
-          body: |
-            Automated HADES package drift check.
+      # GitHub Actions is not permitted to open PRs under the org policy, so
+      # instead of peter-evans/create-pull-request we push the refreshed targets
+      # to a branch and open (or update) a tracking issue. A human opens the PR
+      # from the branch — or enables "Allow GitHub Actions to create and approve
+      # pull requests" in repo settings to restore the automated PR.
+      - name: Detect target drift
+        id: drift
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "No HADES target drift detected."
+            exit 0
+          fi
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          {
+            echo "diffstat<<DIFF_EOF"
+            git diff --stat
+            echo "DIFF_EOF"
+          } >> "$GITHUB_OUTPUT"
 
-            Reports are attached to the workflow run:
-            - latest target drift
-            - stable HADES release lock parity
+      - name: Push drift branch
+        if: steps.drift.outputs.changed == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -C automation/hades-version-drift
+          git add -A
+          git commit -m "chore(hades): refresh target package versions"
+          git push --force origin automation/hades-version-drift
 
-            The latest-target mode may update Parthenon's tracked target versions.
-            The stable-lock mode is reported separately and does not rewrite latest targets.
-          labels: |
-            automation
-            hades
-            dependencies
+      - name: Open or update drift issue
+        if: steps.drift.outputs.changed == 'true'
+        uses: actions/github-script@v9
+        env:
+          DIFFSTAT: ${{ steps.drift.outputs.diffstat }}
+        with:
+          script: |
+            const marker = '<!-- hades-drift-bot -->';
+            const branch = 'automation/hades-version-drift';
+            const title = 'chore(hades): target package version drift detected';
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const compareUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/compare/main...${branch}?expand=1`;
+            const body = [
+              marker,
+              '## HADES target package drift detected',
+              '',
+              'The weekly HADES version check refreshed the tracked target versions and',
+              `pushed the proposed change to \`${branch}\`.`,
+              '',
+              '```',
+              (process.env.DIFFSTAT || '').trim() || '(see workflow run artifacts)',
+              '```',
+              '',
+              `**Review & merge:** [open a PR from \`${branch}\`](${compareUrl}).`,
+              `**Drift reports:** download the \`hades-version-drift\` artifact from ${runUrl}`,
+              '',
+              '> GitHub Actions cannot open the PR directly under the current org/repo',
+              '> policy, so this issue is the notification. Open the PR manually, or enable',
+              '> "Allow GitHub Actions to create and approve pull requests" in Settings →',
+              '> Actions → General to restore the fully-automated flow.',
+            ].join('\n');
+            const open = await github.paginate(github.rest.issues.listForRepo, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              per_page: 100,
+            });
+            const existing = open.find((i) => i.body && i.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: existing.number,
+                body,
+              });
+              core.info(`Updated HADES drift issue #${existing.number}`);
+            } else {
+              const created = await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title,
+                body,
+                labels: ['dependencies'],
+              });
+              core.info(`Opened HADES drift issue #${created.data.number}`);
+            }