feat(gate): open local reusable workflows instead of refusing them

[thymikee]

Summary

The gate-manifest loader refused any job that calls a reusable workflow (uses: ./.github/workflows/x.yml). It now opens a local reusable workflow, so the called workflow's steps, gates, and files count toward the calling lane. Its ${{ inputs.* }} gate names resolve from the caller's with. A remote, missing, jobless, or nested reusable workflow still fails closed. Planted tests cover every case.

This is the base layer of the release-channel stack: release.yml (#3380) calls the iOS runner, Android helper, and MCP Registry workflows this way. 3 files.

Validation

At 6308cbf1be:

• Gate loader and audit tests: 25/25 pass.
• pnpm check:gate-manifest: ok, 53 checks across 26 lanes.
• pnpm check:affected --run passes at the stack top (9d7a69a9f5).

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	5.16 MB	5.16 MB	0 B
Package (unpacked)	5.16 MB	5.16 MB	0 B
Package (download)	1.55 MB	1.55 MB	+1 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	26.1 ms	26.9 ms	+0.8 ms
CLI --help	83.2 ms	84.3 ms	+1.1 ms

[thymikee]

The change to open local reusable workflows in the gate looks correct at 634c1ce. I found nothing to fix. No conflicts.

The Smoke Tests job 114251069258 is still running, so the checks are not final. The other three Smoke Tests jobs passed. The diff touches only the gate scripts and their tests, and no smoke route overlaps it, so I expect that job to pass.

I did not run the tests or the gate-manifest check, so the 22/22 and 53/26 results are the author's. No workflow on main calls a local reusable workflow today, so only the planted test exercises the open path. I could not check from this PR whether the release workflow in #3380 audits correctly. Optionally, add planted tests for the remote and nested fail-closed branches.

Once Smoke Tests finishes green, take the PR out of draft.

[thymikee]

I added planted tests for both fail-closed branches at 441cd1aa84: a remote owner/repo/...@main call and a nested local reusable workflow. Each stays unsupported and contributes no gates. The gate tests pass 23/23. #3380 calls three local reusable workflows, and check:gate-manifest passes with them: 53 checks across 26 lanes.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[thymikee]

The code in 441cd1a looks good. Local reusable workflows now open instead of being refused, and remote, missing and nested callees still fail closed. The earlier review of 634c1ce found nothing, and nothing new came up in this change.

CI is green: all 19 checks pass, and the gate-manifest and gate unit lanes exercise the changed files directly. No conflicts.

Both open cubic-dev-ai threads still apply: the unresolved inputs gate under-credit (#3378 (comment), P2) and the jobless callee opening as a lane (#3378 (comment), P3). Both err toward crediting fewer gates, so they cannot hide a missing check. Passing job.with as inputs into declaredGates fixes the first. Treating an empty called list like a missing file fixes the second. Both are small. Please fix the P2 one here, or reply on that thread with why it can wait, before this is ready; the P3 one can go in a follow-up.

I did not run the gate tests or check:gate-manifest locally, so the 23/23 and 53-checks-across-26-lanes numbers rest on your comment and CI. I also did not read the callee workflows in #3380. If any of them pass a gate through with: gate: ${{ inputs.* }}, the first thread already under-credits there.

[thymikee]

This PR is ready at 6308cbf. Both earlier findings from #3378 (comment) are fixed: gate inputs now resolve from the caller's with, and a reusable workflow with no jobs now fails closed, each with a test that would fail on the old code.

Not blocking, and you can take or leave it: in https://github.com/callstack/agent-device/blob/6308cbf/scripts/gate/workflows.ts#L176 readLocalWorkflowJobs only checks the ./.github/workflows/ prefix, so a path like ./.github/workflows/../../x.yml can read a file outside that directory, and the callee's own on: workflow_call trigger is not checked. The rule could be that a normalized path must stay under .github/workflows/, and ideally the callee must declare workflow_call.

The two cubic-dev-ai threads no longer apply, so please resolve them: the P2 on gate inputs (#3378 (comment)) is fixed by jobSteps passing job.with to declaredGates, and the P3 on jobless callees (#3378 (comment)) is fixed by the fail-closed check.

I did not run the gate tests locally, so the 25/25 and check:gate-manifest results are your claims. I did not read the full body of the renamed audit.test.ts "cannot open" case, so I trust its title and the diff for the missing-file path. Callee inputs.<name>.default values are not resolved, so an omitted caller with leaves the gate undeclared. I did not check how audit reports that case.

The other 18 checks pass. Smoke Tests is still running and shows no failure so far. It looks unrelated, since the diff only touches scripts/gate/workflows.ts and its two test files, and Smoke Tests does not exercise them. There are no conflicts. Once Smoke Tests finishes, this can merge.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-10-11 09:48 UTC