fix(reporting): a failing PR-comment call can no longer red a gate that already decided

[topcoder1]

Incident

2026-08-17 18:29–18:36Z, whois-api-llc/wxa-graph: a ~2-minute GitHub comments-API outage (HTTP 503: No server is currently available to service your request from https://api.github.com/graphql) blocked all 5 open dependabot PRs (#422–#426) on REQUIRED checks whose gates had already passed:

Lane	Gate decision	What actually failed	Evidence
review / Claude Review	bot-skip computed total=1 non-bot=0 and printed it	the unguarded courtesy gh pr comment under set -euo pipefail → step exit 1, and skipped=true never reached GITHUB_OUTPUT	run 32055207194, job 95463657630 (step 3 failure, steps 4–7 skipped)
coverage-floor / Measure coverage and enforce floor	PASS: measured 83.0% vs floor 80.2%	the sticky-comment action step → job failure	run 32055207104

Fix — reporting becomes non-fatal; enforcement stays fatal

• claude-review.yml (bot-skip): skipped=true is written before the comment, and the comment is guarded with a ::warning:: downgrade. A comments-API failure can no longer red the check or erase the decision.
• coverage-floor.yml: continue-on-error: true on the sticky-comment step. The enforce step above it remains the gate, unchanged.
• dependabot-auto-merge.yml (audit hit, same shape): the revoke explanation comment runs after gh pr merge --disable-auto already succeeded — its failure made a succeeded revoke look failed. Now downgraded; the revoke itself stays fatal.
• openapi-types-drift.yml (audit hit, same shape): the stale-comment cleanup runs on the passing (drift=0) path; list/delete failures now degrade to warnings (exit 0). Also moves ${{ github.repository }} into env: REPO, which is what makes the step executable by the selftest.

Audited, deliberately unchanged — comment calls whose failure is load-bearing:

• claude-review's lost-findings fallback comment (fix(claude-review): keep the reviewer single-pass and stop losing inline findings silently #165): must fail rather than stay green over unpostable findings.
• codex-review's verdict comment: it delivers findings the automerge findings gate reads; non-fatal there would fail-open lost findings (the exact fix(claude-review): keep the reviewer single-pass and stop losing inline findings silently #165 class). Pinned by test_codex_verdict_gate_is_wired_and_opt_in.
• pr-classify's sticky: already guarded (retry + warning) since the 2026-06-10 401 incident — the in-repo precedent this PR generalizes.
• claude-author-automerge stickies & the drift=1 comment: not required checks / the job reds anyway on the failing path; a red there is honest alerting-delivery failure, not gate inversion.

Selftests (written first, RED against the old workflows, GREEN after)

• selftest/test_comment_nonfatal_reporting.sh — extracts the shipped bash of all three shell steps and runs it against a gh stub serving the outage's literal 503. Pins per lane: exit 0, decision output/side-effect intact, ::warning:: emitted; controls prove the healthy path, the decision logic, and the counter-invariant (a failed gh pr merge --disable-auto still fails the step). Pre-fix it reproduced the incident byte-for-byte: total=1 non-bot=0 printed, then exit 1 with no skipped=true.
• test_sticky_comment_action_steps_are_nonfatal (test_workflow_guards.py) — sweeps every workflow for sticky-comment action steps and requires continue-on-error: true; anchored to coverage-floor.yml so it can't pass vacuously.

uv run pytest -q: 78 passed (full suite incl. the pre-existing bot-skip authorship test over the reordered step). actionlint on the 4 workflows: no new findings (the SC2016 at coverage-floor.yml:650 pre-exists on main and CI's actionlint runs without shellcheck). shellcheck clean on the new test.

Relation to task_f6871c59 (PR #165)

Same failure shape — the lane decides correctly, then the post-decision reporting path defects — but different mechanisms: #165 was findings silently lost behind a green check (fail-open, from subagent tool denials); this one is reporting failure redding a pass and erasing the decision output (fail-closed noise + lost state, from unguarded error propagation). No shared code path, so no shared one-line fix — the shared principle is now institutionalized instead: reporting non-fatal, enforcement fatal, enforced by the new behavioral selftest plus the repo-wide sticky sweep.

Auto-merge rationale: manual click-merge — PRs to ci-workflows are always manual, and this touches .github/workflows/** (prod infra).
Codex rounds: 2 (both NO FINDINGS).

🤖 Generated with Claude Code

[github-actions]

Risk class: blocked — manual merge required.

This PR touches one of the blocked path categories from .github/risk-paths.yml (Dockerfiles, docker-compose, .github/workflows/**, **/.env*, **/secrets*, infra/, terraform/, k8s/, or the classifier config itself).

Auto-merge is refused by claude-author-automerge.yml. A maintainer should review the diff and click "Squash and merge" themselves.

(This is a policy notice, not a code-quality failure. The classify job itself does not fail — required CI checks remain authoritative for "is the code green.")

[github-actions]

Coverage Floor — mode: enforce

metric	value
measured	100.0%
floor (current)	99.0%
target	100.0%
last bumped	2026-05-12

[claude]

No issues found. Separation of reporting vs. enforcement is correct throughout; counter-invariants (fatal revoke, fatal lost-findings fallback) are intact and pinned by tests.