Harden CI build gating with compiler/linker-only blockers and label state normalization

[Copilot]

Pull Request

For EPIC-branch workflow PRs, use .github/PULL_REQUEST_TEMPLATE/epic-branch-flow.md.
This applies to both feature/* -> epic/* and epic/* -> develop integration PRs.

Target Version (Required)

Target Version: [Unreleased]

Targets CI/governance automation behavior on develop; this is infrastructure hardening, not a runtime release payload.

---

Description

Build-preflight blocking is now strictly tied to compiler/linker failure markers, preventing false build stops from warnings, gaps, or mock-related findings.
The CI label lifecycle was also normalized toward an explicit status-state model to avoid stale or conflicting tracker labels.

• Build blocker semantics

  • check-build-status now blocks only when both ci/build-failed and ci/compiler-linker-failed are present.
  • Non-compiler/linker failures remain visible in tracking labels but do not block new build attempts.

• Stage-aware failure classification

  • build-mainline + reusable cmake workflow now propagate configure/build/validation outcomes.
  • Failure stage drives label emission, separating hard build breakages from downstream/non-blocking failures.

• State-machine label normalization

  • Added/propagated atomic replace_status_group transitions across CI/governance workflows.
  • Introduced consistent process labels (status/needs-attention, status/needs-approval, status/resolved, status/recovered) and domain labels for CI lanes.

• Quarterly pentest workflow alignment

  • security-pentest-quarterly.yml now derives severity/process state from findings JSON and normalizes status groups after issue upsert.

# blocker condition in preflight gate
if has_label("ci/build-failed") && has_label("ci/compiler-linker-failed"):
  fail("active compiler/linker breakage")
else:
  pass("no hard build blocker")

Linked Issues

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Refactoring (non-breaking)
• Documentation
• Breaking change (requires MAJOR version bump — see VERSIONING.md)
• Security fix
• Other: CI/governance workflow hardening

Breaking Change Checklist

• MAJOR version bump planned in VERSION and CMakeLists.txt
• Migration guide added in docs/migration/
• Announcement prepared for GitHub Discussions (≥ 2 weeks before release)
• CHANGELOG ### Removed / ### Changed section updated

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• Benchmarks run (if performance-sensitive change)

Security Tiering Impact (Required for Runtime Changes)

• Impacted tier(s):

  • T0 Trusted Core
  • T1 Security & Platform Services
  • T2 Data Plane Engines
  • T3 Interface & Protocol Edge
  • T4 Managed Extension Runtime
  • T5 Plugin Boundary
  • N/A (docs-only / non-runtime)

• Trust-boundary crossings documented in PR description (example: T3 -> T2, T5 -> T4 brokered call)

• Boundary controls validated for affected T3/T4/T5 paths (AuthN/AuthZ, validation, rate limits, audit)

• Boundary-focused tests added/updated or explicit N/A rationale provided

• If trust level/privilege increased, security maintainer approval is attached

📚 Research & Knowledge (wenn applicable)

• Diese PR basiert auf wissenschaftlichen Paper(s) oder Best Practices?
  • Falls JA: Research-Dateien in /docs/research/ angelegt?
  • Falls JA: Im Modul-README unter "Wissenschaftliche Grundlagen" verlinkt?
  • Falls JA: In /docs/research/implementation_influence/ eingetragen?

Relevante Quellen:

• Paper:
• Best Practice:
• Architecture Decision:

AI-Generated Code (KI-generierter Code)

• Symbol-Referenzen mit GetSymbolReferences_CppTools geprüft (siehe .github/instructions/cpp-language-service-tools.instructions.md)
• Keine rohen Pointer und kein new/delete ohne explizites Review eingeführt
• RAII und Exception-Safety für neue/angepasste Pfade geprüft
• Keine unnötig komplexen KI-Abstraktionen eingeführt
• Performance-Metriken geprüft, falls Hotpath betroffen

AI Review Workflow (Required for AI-assisted PRs)

• Findings-first review performed with .github/prompts/pr-diff-findings-review.prompt.md
• Security hardening review performed for security-sensitive/runtime changes with .github/prompts/security-hardening-review.prompt.md (or N/A documented)
• API impact review performed for API/contract changes with .github/prompts/api-change-impact-review.prompt.md (or N/A documented)
• All Critical/High findings are resolved or explicitly accepted with rationale in PR description
• Residual risks and follow-up actions documented in PR description
• Severity policy applied according to .github/copilot/REVIEW_SEVERITY_POLICY.md

High-Finding Exception Record (only if High is accepted)

• High-finding exception claimed in this PR

• Finding reference:

• Maintainer approver:

• Mitigation in current release:

• Target fix milestone:

• Tracking issue:

• Validation evidence:

Release Readiness Gate (Required for release-scoped changes)

• Release readiness reviewed with .github/prompts/release-readiness-check.prompt.md for branch transition scope
• Branch governance validated against BRANCHING_STRATEGY.md and RELEASE_STRATEGY.md
• Versioning/changelog impact validated against VERSIONING.md and CHANGELOG.md

Checklist

• Code follows project style guidelines (clang-format / clang-tidy)
• Self-review completed
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased]
• No new warnings introduced
• Security-sensitive paths reviewed by security maintainer (if applicable)

Scanner and IntelliSense Gates

• IntelliSense/Compiler: no new errors in changed files
• clang-tidy/cppcheck: no new high-risk findings in changed files
• Gap Scanner: no new critical findings in categories security, input_validation, query_correctness, distributed_consistency, concurrency, memory
• Gap Scanner: no new high findings in the same categories (or explicitly approved)
• Gap Scanner delta report attached (baseline vs current), not only absolute totals
• New unknown scanner findings triaged (fixed, re-categorized, or justified)

[github-actions]

Target: pr

Doxygen Governance Gate

• Verdict: PASS
• Base branch: develop
• Changed C/C++ files: 0
• Scoped modules: none
• Release lane: no
• Phase 6 modules in scope: none
• Coverage enforced: no
• Coverage threshold: 95.0%
• Coverage result: skipped
• Coverage waiver active: no
• Approved waivers: none
• Structural findings: 0
• Advisory findings: 0
• Doxygen warnings: 1
• XML generated: no

Doxygen warnings

• No changed C/C++ files in scope; Doxygen gate skipped.

---

source_workflow: Gate: PR Doxygen Governance
source_run: 33760433268
source_sha: 4e23790

[github-actions]

✅ Wave C Policy Gate: Hash & SBOM Integrity

Result: ✅ Hash & SBOM Integrity PASSED
Workflow run: #33760434194
Triggered by: @Copilot

Checks

• ✅ Dependency hash integrity check
• ✅ SBOM generation and registry consistency
• ✅ Edition-correct SBOM composition
• ✅ Private plugin variance detection
• ℹ️ Approved SBOM registry: docs/governance/SBOM_APPROVED_VERSIONS.md

See .github/workflows/gate-pr-hash-sbom.yml for details.

[github-actions]

✅ Wave C Policy Gate: Edition & License Validation

Result: ✅ Edition & License Validation PASSED
Workflow run: #33760434194
Triggered by: @Copilot

Checks

• ✅ Edition matrix consistency check
• ✅ License feature gate validation
• ✅ Enterprise/military marker detection
• ℹ️ Target branch: develop

See .github/workflows/gate-pr-edition-license.yml for details.

[github-actions]

✅ Wave C Policy Gate: Community Fail-Closed Validation

Result: ✅ Community Fail-Closed Validation PASSED
Workflow run: #33760434194
Triggered by: @Copilot

Checks

• ✅ No silent fallback patterns
• ✅ License disclaimers present
• ✅ No unguarded telemetry/tracking
• ✅ No private plugin references in community/minimal scope
• ✅ Community-only build config validation
• ✅ No enterprise secrets leakage

See .github/workflows/gate-pr-community-failclosed.yml for details.

[github-actions]

✅ Wave C Policy Gate: Private Plugin Boundary Enforcement

Result: ✅ Private Plugin Boundary Enforcement PASSED
Workflow run: #33760434194
Triggered by: @Copilot

Checks

• ✅ Private plugin leakage detection
• ✅ Plugin manifest visibility validation
• ✅ Submodule commit-pin enforcement (no branch refs for private)

See .github/workflows/gate-pr-plugin-boundary.yml for details.

[Copilot]

🟡 Changes recommended

There are concrete workflow logic and automation correctness issues (notably build-mainline dispatch behavior and pentest label derivation error handling) that can lead to skipped builds or incorrect “resolved” labeling.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Hardens CI/governance automation by tightening “hard build blocker” semantics to compiler/linker failures only, and normalizing workflow-driven labels toward an atomic status-group state machine to reduce stale/conflicting labels across trackers and maintenance issues.

Changes:

• Refines build-preflight blocking to require ci/build-failed and ci/compiler-linker-failed, while keeping non-blocking failures visible via separate labels.
• Propagates stage outcomes (configure/build/validation) from reusable CMake builds to drive stage-aware labeling in mainline CI.
• Introduces/standardizes status/* process labels and applies replace_status_group transitions across multiple governance/maintenance workflows.

File summaries

File	Description
.github/workflows/security-pentest-quarterly.yml	Derives severity/process labels from latest pentest findings JSON and normalizes label groups.
.github/workflows/reusable-cmake-build.yml	Exposes configure/build/validation outcomes as reusable-workflow outputs.
.github/workflows/release-mainline.yml	Updates tracker text to reflect new blocker semantics (compiler/linker marker pairing).
.github/workflows/publish-wiki.yml	Refactors argument passing to wiki build/link validation scripts via bash arrays and clearer dry-run output.
.github/workflows/maintenance-issues.yml	Normalizes scanner/security issue labeling and status-group replacement behavior.
.github/workflows/maintenance-ci-health.yml	Adds health banding outputs and expands label normalization for chronic CI health issues.
.github/workflows/maintenance-build-issues.yml	Classifies chronic build errors into more specific labels and normalizes issue labels atomically.
.github/workflows/gate-pr-doxygen-governance.yml	Switches to replace_status_group for Doxygen label transitions and adds process labels.
.github/workflows/compliance-supply-chain.yml	Derives dependency freshness state labels, normalizes status groups, and adds recovery comments.
.github/workflows/compliance-governance-gates.yml	Tightens waiver command parsing trigger, adds waiver-requested state, and normalizes multiple issue state groups.
.github/workflows/build-mainline.yml	Adds pending-state marker job and stage-aware labeling (compiler/linker vs validation failures).
.github/workflows/build-llm-inference.yml	Consolidates LLM CI failure tracking per ref and normalizes failure/recovery labels.
.github/workflows/build-benchmarks.yml	Updates tracker text to reflect new blocker semantics.
.github/workflows/13-wave-b-transaction-ci-execution.yml	Improves shell quoting, report generation robustness, and bumps github-script to v7.
.github/workflows/13-wave-b-llm-wiki-benchmarks.yml	Improves shell redirection/quoting for GPU detection and output writes.
.github/workflows/13-wave-a-gpu-ci-execution.yml	Updates cache/artifact actions to v4 and refactors target lists to bash arrays for safer expansion.
.github/WORKFLOW_GUIDELINES.md	Documents new blocker semantics and introduces canonical CI label state machine guidance.
.github/milestones.yml	Updates milestone assignment rules to align with new status/* process labels for LLM triage.
.github/labels.yml	Updates label definitions/types and adds new CI/process/governance labels.
.github/actions/status-flags-and-issues/action.yml	Extends label palette and supports atomic replace_status_group transitions used across workflows.
.github/actions/check-build-status/action.yml	Updates preflight gate to block only on paired build-failed + compiler/linker marker labels.

Review details

• Files reviewed: 21/21 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Implemented in d4225c5. The pentest-label derivation now emits a warning when findings JSON parsing fails (or file is missing) and forces a non-resolved label state (severity:medium, status/needs-attention) instead of falling back to severity:low,status/resolved.

[Copilot]

Implemented in d4225c5. mark-build-pending and update-build-labels now run for both push and workflow_dispatch, so manual dispatch no longer skips build via unmet needs, and pending status is still cleared by the final label update.

[Copilot]

Implemented in d4225c5. I removed the duplicate ci/compiler-linker-failed blocker-label row and merged source/cleanup semantics into a single entry covering both build-mainline.yml and maintenance-build-issues.yml.