ci: gate live-e2e jobs on static-offline via needs: (prevents wasted env-approvals on runs that would fail static)

Author: clkao

.github/workflows/runtime-live-e2e.yml

@@ -49,7 +49,29 @@ permissions:
   pull-requests: read
 
 jobs:
+  # Gate job: static suite must pass before any live-e2e job burns env-approval.
+  # Duplicate of the standalone Static CI workflow (ci-static.yml); intentional
+  # redundancy lets the live-e2e jobs `needs:` it natively without cross-workflow
+  # orchestration. The standalone workflow stays for the top-level PR status card.
+  static-offline:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - uses: astral-sh/setup-uv@v6
+
+      - name: Run offline static suite
+        run: make test-static
+
   claude-live:
+    needs: static-offline
     runs-on: ubuntu-latest
     environment:
       name: CI-E2E
@@ -194,6 +216,7 @@ jobs:
           if-no-files-found: warn
 
   claude-live-bare:
+    needs: static-offline
     runs-on: ubuntu-latest
     environment:
       name: CI-E2E
@@ -338,6 +361,7 @@ jobs:
           if-no-files-found: warn
 
   claude-live-opus:
+    needs: static-offline
     runs-on: ubuntu-latest
     environment:
       name: CI-E2E-OPUS
@@ -490,6 +514,7 @@ jobs:
           if-no-files-found: warn
 
   codex-live:
+    needs: static-offline
     runs-on: ubuntu-latest
     environment:
       name: CI-E2E-CODEX

tests/test_runtime_live_e2e_workflow.py

@@ -70,15 +70,19 @@ def test_runtime_live_e2e_workflow_supports_pr_and_manual_triggers():
 
 
 def test_runtime_live_e2e_workflow_checks_out_pr_head_with_persist_credentials_false():
-    """Security-critical: every live-e2e checkout must target the PR head SHA
-    and MUST set persist-credentials: false so GITHUB_TOKEN is not persisted
-    into .git/config where post-checkout steps could use it."""
+    """Security-critical: every checkout in this workflow must target the PR head
+    SHA and MUST set persist-credentials: false so GITHUB_TOKEN is not persisted
+    into .git/config where post-checkout steps could use it.
+
+    Five checkouts in current shape: 4 live-e2e jobs (claude-live, claude-live-bare,
+    claude-live-opus, codex-live) + 1 static-offline gate job. All five must
+    satisfy the head-SHA + persist-credentials invariant."""
     text = read_workflow()
 
     checkout_count = text.count("actions/checkout@v4")
     head_ref_count = text.count("ref: ${{ github.event.pull_request.head.sha }}")
     # Each checkout must have a matching head-SHA ref.
-    assert checkout_count == 4
+    assert checkout_count == 5
     assert head_ref_count == checkout_count, (
         f"Every checkout@v4 must pin to the PR head SHA "
         f"(found {checkout_count} checkouts, {head_ref_count} head-SHA refs)"
@@ -92,6 +96,23 @@ def test_runtime_live_e2e_workflow_checks_out_pr_head_with_persist_credentials_f
     )
 
 
+def test_runtime_live_e2e_workflow_gates_live_jobs_on_static_offline():
+    """Live-e2e jobs MUST NOT run if static-offline fails. Captain env-approval
+    is expensive; gating on static-offline prevents wasted approvals on runs
+    that would fail on static checks anyway."""
+    text = read_workflow()
+
+    # The gate job must exist inline (not only in the standalone ci-static.yml).
+    assert "  static-offline:\n" in text, (
+        "Expected a static-offline job in runtime-live-e2e.yml as the needs: target"
+    )
+    # All 4 live jobs must declare needs: static-offline.
+    needs_count = text.count("needs: static-offline")
+    assert needs_count == 4, (
+        f"Expected all 4 live-e2e jobs to declare 'needs: static-offline', got {needs_count}"
+    )
+
+
 def test_runtime_live_e2e_workflow_narrows_default_permissions():
     text = read_workflow()