Module workflow_jobs 

Whether the job --required-check names is shaped to report a blocking answer.

The trunk protection requires exactly two status-check contexts: the named check and the title check. Which other jobs a project means to block a merge is intent, and no file states it, so this reader makes no claim about them: gate.needs is the voting list by convention, and forges/github.md owns that convention. What this reader judges is the gate itself, in five ways it can fail to report: no job reports the context, more than one does, the condition is not proven to survive a failed dependency, the needs value is not a literal list, and the trigger filters the request away. It reads the workflow text line by line, in the same spirit as the landing invariants: where a value sits somewhere this reader does not follow, it says so rather than guessing.

It does not prove that the gate holds a merge. A gate under a proven condition with a literal needs still passes if its steps never inspect the results, and that is script semantics this reader does not run.

Structs

GateReport

The reading and what the reader judges beside it.

Trigger

What a workflow’s pull-request trigger filters by.

Enums

Condition

The gate job’s if condition, as far as the reader proves it.

GateReading

What the workflows say about the required check.

Functions

faults

The ways the gate is shaped so that it cannot report a blocking answer, or nothing where its shape is sound.

read_gate

Read every workflow under the target’s .github/workflows and judge the named check against the jobs that report on a pull request.