ci: require no-mistakes pipeline attestation in the gate

[kunchenguid]

What changed

Mirrors the attestation gate that landed on gh-axi main (kunchenguid/gh-axi#111) into this repo's .github/workflows/no-mistakes-required.yml.

The gate step's inline run: script is now byte-for-byte identical to gh-axi's (verified by parsing both workflows and comparing jobs.check.steps[0].run: 6583 chars, identical). It now:

• keeps the existing "signature missing" failure path;
• requires the <!-- no-mistakes-pipeline-attestation:v1 {...} --> comment, and fails with no-mistakes >= 1.46.0 is required (PR 670) when the signature is present but the attestation is missing;
• extracts the payload by exact substring (no regex) and fails closed if the comment is never closed;
• jq-parses steps[] and requires review, test, and document to all be status == "completed" (every record, if a step appears twice);
• rejects any skip-shaped sibling key (skip*, quota*, *unavailable) on a required step, so a skip can never ride along on a completed status;
• fails closed on malformed/unparseable JSON, and asserts a verdict was reached for all 3 required steps.

This repo's own triggers and exemptions are untouched. on: (types/branches/paths-ignore including the packages/axi-sdk-js/** release-please paths), concurrency, permissions, the author exemption if:, and the job name PR must be raised via no-mistakes are all exactly as before. Only the step name and the script body changed.

Test

New test/no-mistakes-gate.test.mjs (node:test, matching this repo's root node --test convention) parses the workflow YAML, extracts that exact inline block, writes it to a temp file, and executes it with bash against fixture PR bodies - so it exercises what CI runs, not a copy.

Wired up as pnpm run test:workflows and run in CI by the new no-mistakes-gate-test workflow (path-filtered to the gate, its test, and lockfile/manifest). The test throws on CI if bash/jq are unavailable, so it can never silently skip there.

pnpm run test:workflows - 17/17 pass

$ node --test test/no-mistakes-gate.test.mjs
▶ no-mistakes PR gate
  ✔ accepts a body whose attestation completes review, test, and document (127.533375ms)
  ✔ still rejects a body with no no-mistakes signature (20.305834ms)
  ✔ rejects a signed body with no attestation and names the required version (71.213958ms)
  ✔ rejects an attestation whose test step is skipped (144.828792ms)
  ✔ rejects an attestation whose test step is failed (90.678ms)
  ✔ rejects an attestation whose test step is running (97.759792ms)
  ✔ rejects an attestation whose test step is pending (95.561083ms)
  ✔ rejects an attestation that omits a required step entirely (73.789ms)
  ✔ rejects a required step recorded twice unless every record completed (97.998167ms)
  ✔ rejects a completed step carrying a skip_reason marker (99.103375ms)
  ✔ rejects a completed step carrying a skipped marker (245.205667ms)
  ✔ rejects a completed step carrying a agent_unavailable marker (104.858209ms)
  ✔ rejects a completed step carrying a quota_exhausted marker (84.584ms)
  ✔ fails closed on an attestation payload that is not valid JSON (54.725125ms)
  ✔ fails closed when the payload has no steps array (90.003375ms)
  ✔ fails closed when the attestation comment is never closed (141.863792ms)
  ✔ accepts a CRLF body (75.507375ms)
✔ no-mistakes PR gate (1718.605292ms)
ℹ tests 17
ℹ suites 1
ℹ pass 17
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 1995.201

packages/axi-sdk-js/test/release-ci-exclusions.test.ts asserts the exact inventory of workflows that carry a pull_request trigger, so the new workflow is registered there. Its path filter selects nothing in the release-output set (root package.json is not packages/axi-sdk-js/package.json), so a release-please PR still creates no run for it.

Notes

The advisory PR must be raised via no-mistakes check will fail on this PR: it is a direct PR with no pipeline signature. That is expected and non-blocking for internal CI tooling. The real checks (gate test, lint/format, docs, build/test, guard) must be green.