ci: harden merge-gate (fail-closed, rerun-safe, robust PR resolution)

Address review of the ci/merge-gate convergence:

- Extract shared logic to .github/workflows/scripts/merge-gate.js; both
  entry points use it (no drift).
- merge-gate.yml now also listens to 'External PR credential-free
  validation' and triggers on in_progress + completed, forcing a
  re-running workflow's own input to pending so an earlier success can't
  linger during a same-SHA rerun.
- Fork side persists the approved Cypress result as the ci/fork-cypress
  commit status and an early mark-fork-gate-pending job brackets the
  rerun window; the gate is recomputed on both fork inputs, closing the
  stale-success / stuck-pending holes.
- Both entry points validate open + base==release + head.sha==written-SHA
  before writing (no stale writes, no reuse after base retarget).
- Robust PR resolution: workflow_run.pull_requests -> head owner:branch
  -> commit association, unique exact-SHA match only, no arbitrary
  fallback; null head.repo treated as fork.
- ci/fork-cypress requires exactly one Cypress result job to have run.

Fail-closed throughout: skipped/neutral/missing/in-flight => pending.

Linear: https://linear.app/appsmith/issue/APP-15921

Author: subrata71

.github/workflows/build-client-server.yml

@@ -10,10 +10,12 @@ concurrency:
 
 permissions:
   actions: read
+  checks: read
   contents: read
   issues: write
   packages: write
   pull-requests: write
+  statuses: write
 
 jobs:
   file-check:
@@ -766,11 +768,52 @@ jobs:
         if: needs.ci-test-limited-existing-docker-image.result != 'success'
         run: exit 1
 
-  # Publish the single required merge gate (`ci/merge-gate`) for FORK PRs on the
-  # maintainer-approved head SHA. This dispatch is triggered by `/approve-ci`, so
-  # it runs trusted and may hold statuses: write. Internal PRs get ci/merge-gate
-  # from merge-gate.yml instead; the fork-only guard below prevents both paths
-  # from writing the same context on one PR. See merge-gate.yml for the rationale.
+  # Fork PRs: mark the single required gate `pending` as soon as an approved-CI
+  # run starts, so an earlier `success` cannot linger while the same commit is
+  # re-tested. Internal PRs are owned by merge-gate.yml (guarded out below). No
+  # checkout here (no fork code) — the PR number/head come from the trusted
+  # dispatch payload.
+  mark-fork-gate-pending:
+    name: mark-fork-gate-pending
+    if: github.event.action == 'approve-ci-command'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set ci/merge-gate pending for the fork PR
+        uses: actions/github-script@v7
+        env:
+          HEAD_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
+          PR_NUMBER: ${{ github.event.client_payload.pull_request.number }}
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const { HEAD_SHA, PR_NUMBER } = process.env;
+            const pr = (
+              await github.rest.pulls.get({ owner, repo, pull_number: Number(PR_NUMBER) })
+            ).data;
+            const isFork = !pr.head.repo || pr.head.repo.full_name !== `${owner}/${repo}`;
+            if (!isFork) {
+              core.info(`PR #${PR_NUMBER} is internal; merge-gate.yml owns it. Skipping.`);
+              return;
+            }
+            if (pr.state !== "open" || pr.base.ref !== "release" || pr.head.sha !== HEAD_SHA) {
+              core.info(`PR #${PR_NUMBER} not gatable / head moved; skipping.`);
+              return;
+            }
+            await github.rest.repos.createCommitStatus({
+              owner,
+              repo,
+              sha: HEAD_SHA,
+              state: "pending",
+              context: "ci/merge-gate",
+              description: "Approved CI running…",
+              target_url: `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`,
+            });
+
+  # Fork PRs: persist the approved Cypress result (`ci/fork-cypress`) on the
+  # approved head SHA, then write the single required `ci/merge-gate`. Uses the
+  # shared gate script, checked out from the trusted base repo (a
+  # repository_dispatch run defaults to the default branch — never fork code).
+  # Internal PRs are owned by merge-gate.yml (guarded out below).
   set-fork-merge-gate:
     name: set-fork-merge-gate
     needs:
@@ -782,92 +825,55 @@ jobs:
       ]
     if: always() && github.event.action == 'approve-ci-command' && needs.file-check.outputs.pr != '0'
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      checks: read
-      pull-requests: read
-      statuses: write
     steps:
-      - name: Set ci/merge-gate for the fork PR
+      - name: Checkout base repo (trusted — for the shared gate script only)
+        uses: actions/checkout@v4
+
+      - name: Write ci/merge-gate for the fork PR
         uses: actions/github-script@v7
         env:
+          NODE_PATH: ${{ github.workspace }}/.github/workflows/scripts
           HEAD_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
           PR_NUMBER: ${{ needs.file-check.outputs.pr }}
           CYPRESS_LIMITED: ${{ needs.ci-test-limited-result.result }}
           CYPRESS_FULL: ${{ needs.ci-test-full-result.result }}
           CYPRESS_EXISTING: ${{ needs.ci-test-limited-result-existing.result }}
         with:
           script: |
-            const GATE = "ci/merge-gate";
+            const gate = require("merge-gate.js");
             const { owner, repo } = context.repo;
             const { HEAD_SHA, PR_NUMBER, CYPRESS_LIMITED, CYPRESS_FULL, CYPRESS_EXISTING } = process.env;
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
 
-            // Only fork PRs are gated here; internal PRs are owned by merge-gate.yml.
             const pr = (
               await github.rest.pulls.get({ owner, repo, pull_number: Number(PR_NUMBER) })
             ).data;
-            if (pr.head.repo.full_name === `${owner}/${repo}`) {
+
+            // Only fork PRs are gated here; internal PRs are owned by merge-gate.yml.
+            if (!gate.isFork(pr, owner, repo)) {
               core.info(`PR #${PR_NUMBER} is internal; merge-gate.yml owns its status. Skipping.`);
               return;
             }
 
-            // Exactly one of the three Cypress result jobs runs per invocation;
-            // the others report 'skipped'. Cypress is green only if the one that
-            // actually ran succeeded.
-            const cypressRuns = [CYPRESS_LIMITED, CYPRESS_FULL, CYPRESS_EXISTING].filter(
-              (r) => r !== "skipped",
-            );
-            const cypress =
-              cypressRuns.length === 0
-                ? "pending"
-                : cypressRuns.every((r) => r === "success")
-                  ? "success"
-                  : "failure";
-
-            // Credential-free validation (external-ci-result) runs in a separate
-            // workflow on the same head SHA; read its latest conclusion.
-            const checks = await github.paginate(github.rest.checks.listForRef, {
+            // Persist the approved Cypress result on the approved head SHA, then
+            // compute the gate from external-ci-result + that result. Passing the
+            // just-computed state avoids a read-after-write race on the status.
+            const forkCypressState = await gate.publishForkCypress({
+              github,
               owner,
               repo,
-              ref: HEAD_SHA,
-              per_page: 100,
+              sha: HEAD_SHA,
+              results: [CYPRESS_LIMITED, CYPRESS_FULL, CYPRESS_EXISTING],
+              runUrl,
             });
-            const ext = checks
-              .filter((c) => c.name === "external-ci-result")
-              .sort((a, b) => new Date(b.started_at ?? 0) - new Date(a.started_at ?? 0))[0];
-            let credFree = "pending";
-            if (ext && ext.status === "completed") {
-              credFree =
-                ext.conclusion === "success"
-                  ? "success"
-                  : ext.conclusion === "skipped" || ext.conclusion === "neutral"
-                    ? "pending"
-                    : "failure";
-            }
 
-            const parts = { "external-ci-result": credFree, "approved Cypress": cypress };
-            const failed = Object.entries(parts).filter(([, v]) => v === "failure").map(([k]) => k);
-            const pending = Object.entries(parts).filter(([, v]) => v === "pending").map(([k]) => k);
-
-            let state, description;
-            if (failed.length) {
-              state = "failure";
-              description = `Failed: ${failed.join(", ")}`.slice(0, 140);
-            } else if (pending.length) {
-              state = "pending";
-              description = `Waiting: ${pending.join(", ")}`.slice(0, 140);
-            } else {
-              state = "success";
-              description = "Credential-free + approved Cypress passed";
-            }
-
-            core.info(`Setting ${GATE}=${state} on ${HEAD_SHA} for fork PR #${PR_NUMBER} (${description})`);
-            await github.rest.repos.createCommitStatus({
+            await gate.evaluate({
+              github,
+              core,
               owner,
               repo,
               sha: HEAD_SHA,
-              state,
-              context: GATE,
-              description,
-              target_url: `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`,
+              pr,
+              forkCypressState,
+              runUrl,
             });

.github/workflows/merge-gate.yml

@@ -2,31 +2,33 @@ name: Merge gate
 
 # Single required status context (`ci/merge-gate`) that both internal and fork
 # PRs to `release` can satisfy. Branch protection on `release` requires
-# `ci/merge-gate`; the per-flow checks it aggregates (qc-result,
-# `perform-test / ci-test-result`, external-ci-result, approved Cypress) are no
-# longer individually required — each PR type only ever produces one of the two
-# sets, and a raw required context that is skipped/absent on the other type
-# stays "Expected" forever and blocks the merge (this is exactly the bug that
-# left fork PRs unmergeable after the external-contributor flow shipped).
+# `ci/merge-gate`; the per-flow checks it aggregates (`qc-result`,
+# `perform-test / ci-test-result`, `external-ci-result`, approved Cypress) are
+# no longer individually required — each PR type only ever produces one of the
+# two sets, and a raw required context that is skipped/absent on the other type
+# stays "Expected" forever and blocks the merge (the bug this fixes).
 #
-# Ownership of the write is split by which flow knows the PR head SHA:
-#   - Internal PRs: THIS workflow, triggered by the internal PR workflows'
-#     completion (their head_sha is the PR head).
-#   - Fork PRs: build-client-server.yml sets `ci/merge-gate` on `/approve-ci`,
-#     where the approved head SHA is known. This workflow skips forks.
-# A PR is exactly one of the two, so the context is written by exactly one path
-# and the two setters never race.
+# This workflow recomputes the gate for the PR associated with a feeding
+# workflow's run, on both rerun start (`in_progress`) and `completed`:
+#   - `in_progress` forces the feeding workflow's own input to `pending`, so an
+#     earlier success cannot linger while that workflow re-runs on the same SHA.
+#   - `completed` reads the head SHA's checks/statuses and writes success /
+#     failure / pending (fail-closed: skipped/neutral/absent => pending).
+# It owns internal PRs outright and recomputes the fork credential-free side;
+# the fork Cypress side is written by build-client-server.yml on `/approve-ci`.
 #
-# Security: this workflow never checks out or runs PR code — it only calls the
-# GitHub API — and runs from the default branch in the base-repo context, so
-# holding `statuses: write` is safe even when the associated PR is from a fork.
+# Security: it never checks out or runs PR code — it only checks out the base
+# repo for the shared script and calls the GitHub API — and runs from the
+# default branch in the base-repo context, so holding `statuses: write` is safe
+# even when the associated PR is from a fork.
 
 on:
   workflow_run:
     workflows:
       - "Quality checks"
       - "PR Automation test suite"
-    types: [completed]
+      - "External PR credential-free validation"
+    types: [in_progress, completed]
 
 permissions:
   contents: read
@@ -36,106 +38,40 @@ permissions:
 
 concurrency:
   # Serialize evaluations per head SHA so concurrent triggers don't race on the
-  # commit-status write; queue rather than cancel so the latest state wins.
+  # status write; queue rather than cancel so the latest state always wins.
   group: merge-gate-${{ github.event.workflow_run.head_sha }}
   cancel-in-progress: false
 
 jobs:
   evaluate:
     runs-on: ubuntu-latest
     steps:
-      - name: Evaluate internal merge gate
+      - name: Checkout base repo (trusted — for the shared gate script only)
+        uses: actions/checkout@v4
+
+      - name: Evaluate merge gate
         uses: actions/github-script@v7
         env:
-          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+          NODE_PATH: ${{ github.workspace }}/.github/workflows/scripts
         with:
           script: |
-            const GATE = "ci/merge-gate";
+            const gate = require("merge-gate.js");
             const { owner, repo } = context.repo;
-            const sha = process.env.HEAD_SHA;
-            if (!sha) {
-              core.info("No head SHA on the triggering run; skipping.");
-              return;
-            }
+            const run = context.payload.workflow_run;
+            const sha = run.head_sha;
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
 
-            // Resolve the open PR whose head is this SHA.
-            const assoc = await github.paginate(
-              github.rest.repos.listPullRequestsAssociatedWithCommit,
-              { owner, repo, commit_sha: sha, per_page: 100 },
-            );
-            const pr =
-              assoc.find((p) => p.state === "open" && p.head.sha === sha) ??
-              assoc.find((p) => p.state === "open");
+            const pr = await gate.resolvePr({ github, owner, repo, sha, workflowRun: run });
             if (!pr) {
-              core.info(`No open PR found for ${sha}; skipping.`);
-              return;
-            }
-
-            // Only gate PRs targeting release — the branch whose protection
-            // requires ci/merge-gate.
-            if (pr.base.ref !== "release") {
-              core.info(`PR #${pr.number} targets ${pr.base.ref}, not release; skipping.`);
+              core.info(`No unique open PR found for ${sha}; skipping.`);
               return;
             }
 
-            // Fork PRs get ci/merge-gate from build-client-server.yml on
-            // /approve-ci; this workflow owns internal PRs only.
-            if (pr.head.repo.full_name !== `${owner}/${repo}`) {
-              core.info(`PR #${pr.number} is a fork; build-client-server.yml owns its status. Skipping.`);
-              return;
-            }
-
-            // Read the latest run of each required internal check on the head SHA.
-            const checks = await github.paginate(github.rest.checks.listForRef, {
-              owner,
-              repo,
-              ref: sha,
-              per_page: 100,
-            });
-            const latest = new Map();
-            for (const c of checks) {
-              const prev = latest.get(c.name);
-              if (!prev || new Date(c.started_at ?? 0) >= new Date(prev.started_at ?? 0)) {
-                latest.set(c.name, c);
-              }
-            }
-            // A skipped/neutral required check means "not satisfied yet" (e.g. an
-            // internal PR without ok-to-test never ran Cypress) — treat as
-            // pending so the gate blocks, matching pre-existing behavior.
-            const outcome = (name) => {
-              const c = latest.get(name);
-              if (!c || c.status !== "completed") return "pending";
-              if (c.conclusion === "success") return "success";
-              if (c.conclusion === "skipped" || c.conclusion === "neutral") return "pending";
-              return "failure";
-            };
-
-            const parts = {
-              "qc-result": outcome("qc-result"),
-              "perform-test / ci-test-result": outcome("perform-test / ci-test-result"),
-            };
-            const failed = Object.entries(parts).filter(([, v]) => v === "failure").map(([k]) => k);
-            const pending = Object.entries(parts).filter(([, v]) => v === "pending").map(([k]) => k);
-
-            let state, description;
-            if (failed.length) {
-              state = "failure";
-              description = `Failed: ${failed.join(", ")}`.slice(0, 140);
-            } else if (pending.length) {
-              state = "pending";
-              description = `Waiting: ${pending.join(", ")}`.slice(0, 140);
-            } else {
-              state = "success";
-              description = "Quality checks + Cypress passed";
+            // A rerun that just started means its result is in flight — force
+            // that input to `pending` so an existing success can't linger.
+            const pendingChecks = new Set();
+            if (run.status === "in_progress" && gate.WORKFLOW_TO_CHECK[run.name]) {
+              pendingChecks.add(gate.WORKFLOW_TO_CHECK[run.name]);
             }
 
-            core.info(`Setting ${GATE}=${state} on ${sha} for internal PR #${pr.number} (${description})`);
-            await github.rest.repos.createCommitStatus({
-              owner,
-              repo,
-              sha,
-              state,
-              context: GATE,
-              description,
-              target_url: `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`,
-            });
+            await gate.evaluate({ github, core, owner, repo, sha, pr, pendingChecks, runUrl });