Intake gate: honour the bypass label on its own, keep refused reopens managed

Review follow-ups:

- Adding `bypass-issue-check` is now a real override: the workflow listens
  for that `labeled` event (and only that label), so the bot comment's
  third suggestion works without an accompanying reopen.
- When GitHub refuses to reopen a PR, put the control label (back) on so
  the PR stays gate-managed and a later edit or override retries, rather
  than falling out of scope after a label-removal override.
- On assignment, check the just-assigned issue first so the reference cap
  can't hide it.
- Tolerate a concurrent delete of the gate comment, as label removal
  already does.
- Run the scenario tests on Node 24 to match the github-script runtime.

Four scenarios added for the above.

No-Verification-Needed: workflow script, its tests, and CI wiring only
Signed-off-by: Max Isbey <224885523+maxisbey@users.noreply.github.com>

Author: maxisbey

.github/scripts/pr_intake_gate.js

@@ -6,8 +6,9 @@
 // is either assigned to the PR author or labeled `help wanted`. Otherwise the
 // gate labels it `missing-issue-link`, leaves one comment, and closes it. It
 // re-evaluates — and reopens — the PR when the description is edited or the
-// author is assigned to the issue. A triage+ user reopening the PR or removing
-// the label is a sticky override (`bypass-issue-check`).
+// author is assigned to the issue. A triage+ user reopening the PR, removing
+// the label, or adding `bypass-issue-check` overrides it, and the override
+// sticks.
 //
 // Everything that writes goes through mutate(), so with ENFORCE unset the run
 // only logs what it would have done.
@@ -37,7 +38,7 @@ module.exports = async function run({ github, context, core }) {
     });
     const prs = closed.filter((i) => i.pull_request && closingRefs(i.body).includes(issueNumber));
     console.log(`#${issueNumber} assigned to ${assignee}: ${prs.length} gate-closed PR(s) reference it`);
-    for (const pr of prs) await evaluate(pr.number, 'assigned', context.payload.sender?.login);
+    for (const pr of prs) await evaluate(pr.number, 'assigned', context.payload.sender?.login, issueNumber);
     return;
   }
 
@@ -52,7 +53,7 @@ module.exports = async function run({ github, context, core }) {
 
   // ── The rules ────────────────────────────────────────────────────────────
 
-  async function evaluate(prNumber, action, sender) {
+  async function evaluate(prNumber, action, sender, hintIssue = null) {
     // Always read the PR live; the event payload can be stale by the time a
     // queued run starts.
     const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: prNumber });
@@ -81,10 +82,13 @@ module.exports = async function run({ github, context, core }) {
     if (labels.includes(BYPASS_LABEL)) return pass(`carries ${BYPASS_LABEL}`);
 
     // 3. The rule: the description links an open issue in this repo that is
-    //    labeled `help wanted` or assigned to the author.
+    //    labeled `help wanted` or assigned to the author. Only the first few
+    //    references are fetched; a just-assigned issue is checked first.
     const author = pr.user.login.toLowerCase();
+    const refs = closingRefs(pr.body);
+    if (hintIssue && refs.includes(hintIssue)) refs.unshift(...refs.splice(refs.indexOf(hintIssue), 1));
     const linked = [];
-    for (const num of closingRefs(pr.body).slice(0, MAX_ISSUES)) {
+    for (const num of refs.slice(0, MAX_ISSUES)) {
       const issue = await getIssue(num);
       if (!issue) continue; // missing, a PR, closed, or transferred away
       linked.push(num);
@@ -205,16 +209,17 @@ module.exports = async function run({ github, context, core }) {
   }
 
   // Reopen a gate-closed PR. GitHub refuses (422) if the branch was rewritten
-  // or deleted while closed, or another open PR uses it. That state is
-  // terminal for this PR, so just explain it in the comment; the control
-  // label is left as it is (still on, unless a maintainer removed it).
+  // or deleted while closed, or another open PR uses it. Explain that in the
+  // comment and make sure the control label is (still) on, so the PR stays
+  // gate-managed and a later edit or override retries the reopen.
   async function reopen(pr, reason) {
     try {
       await mutate(`reopen PR #${pr.number}`, () => github.rest.pulls.update({ owner, repo, pull_number: pr.number, state: 'open' }));
       return true;
     } catch (e) {
       if (e.status !== 422) throw e;
       core.warning(`GitHub refused to reopen PR #${pr.number}: ${e.message}`);
+      await addLabel(pr.number, LABEL);
       await upsertGateComment(pr.number, cannotReopenComment(pr, reason));
       return false;
     }
@@ -272,6 +277,13 @@ module.exports = async function run({ github, context, core }) {
 
   async function deleteGateComment(prNumber) {
     const existing = await findGateComment(prNumber);
-    if (existing) await mutate(`delete the gate comment on PR #${prNumber}`, () => github.rest.issues.deleteComment({ owner, repo, comment_id: existing.id }));
+    if (!existing) return;
+    await mutate(`delete the gate comment on PR #${prNumber}`, async () => {
+      try {
+        await github.rest.issues.deleteComment({ owner, repo, comment_id: existing.id });
+      } catch (e) {
+        if (e.status !== 404) throw e; // already deleted by a concurrent run
+      }
+    });
   }
 };

.github/scripts/pr_intake_gate.test.js

@@ -180,6 +180,31 @@ const scenarios = [
     event: edited(3300, 'outsider'),
     expect: { 3300: { state: 'closed', labels: [LABEL], comment: 'cannot-reopen' } },
   },
+  {
+    name: 'gate-closed PR: maintainer adds the bypass label → reopened, and the label sticks',
+    prs: [pr(3300, 'outsider', { state: 'closed', labels: [LABEL, BYPASS], gateComment: true })], // payload arrives post-label
+    event: labeled(3300, 'maintainer', BYPASS),
+    expect: { 3300: { state: 'open', labels: [BYPASS], comment: null } },
+  },
+  {
+    name: 'refused reopen after a label-removal override → both labels on, so the PR stays gate-managed',
+    prs: [pr(3300, 'outsider', { state: 'closed', labels: [], gateComment: true, refuseReopen: true })],
+    event: unlabeled(3300, 'triager'),
+    expect: { 3300: { state: 'closed', labels: [BYPASS, LABEL], comment: 'cannot-reopen' } },
+  },
+  {
+    name: 'after a refused reopen, once the branch is restored an edit retries and reopens',
+    prs: [pr(3300, 'outsider', { state: 'closed', labels: [BYPASS, LABEL], comments: [{ user: 'github-actions[bot]', body: "<!-- require-linked-issue -->\n…GitHub won't let it be reopened…" }] })],
+    event: edited(3300, 'outsider'),
+    expect: { 3300: { state: 'open', labels: [BYPASS], comment: null } },
+  },
+  {
+    name: 'assignment reopens the PR even when the assigned issue is referenced after several others',
+    prs: [pr(3300, 'outsider', { state: 'closed', labels: [LABEL], body: 'Fixes #1 fixes #2 fixes #3 fixes #4 fixes #5 fixes #6', gateComment: true })],
+    issues: [issue(1), issue(2), issue(3), issue(4), issue(5), issue(6, { assignees: ['outsider'] })],
+    event: assigned(6, 'outsider', 'maintainer'),
+    expect: { 3300: { state: 'open', labels: [], comment: null } },
+  },
   {
     name: 'a comment planted by the author with the marker is ignored; the gate posts its own',
     prs: [pr(3300, 'outsider', { comments: [{ user: 'outsider', body: '<!-- require-linked-issue -->\nnice try' }] })],
@@ -234,6 +259,7 @@ function edited(number, sender) { return prEvent('edited', number, sender); }
 function reopened(number, sender) { return prEvent('reopened', number, sender); }
 function readyForReview(number, sender) { return prEvent('ready_for_review', number, sender); }
 function unlabeled(number, sender) { return prEvent('unlabeled', number, sender, { label: { name: LABEL } }); }
+function labeled(number, sender, name) { return prEvent('labeled', number, sender, { label: { name } }); }
 function assigned(issueNumber, assignee, sender) {
   return { eventName: 'issues', payload: { action: 'assigned', issue: { number: issueNumber }, assignee: { login: assignee }, sender: { login: sender } } };
 }

.github/workflows/require-linked-issue.yml

@@ -5,7 +5,8 @@
 # an open issue here that is assigned to them (or labeled `help wanted`);
 # otherwise it is labeled `missing-issue-link`, gets one comment, and is closed,
 # and it reopens automatically once the author is assigned. Bots and drafts are
-# skipped. A triage+ user reopening the PR or removing the label overrides.
+# skipped. A triage+ user reopening the PR, removing the label, or adding
+# `bypass-issue-check` overrides.
 #
 # Operating it:
 #   - Dry-run until the repository variable PR_GATE_ENFORCE is set to "true".
@@ -25,7 +26,7 @@ name: Require Linked Issue
 
 on:
   pull_request_target: # zizmor: ignore[dangerous-triggers] checks out the default branch only and never runs PR code — see header
-    types: [opened, edited, reopened, ready_for_review, unlabeled]
+    types: [opened, edited, reopened, ready_for_review, labeled, unlabeled]
   issues:
     types: [assigned]
   workflow_dispatch:
@@ -41,7 +42,8 @@ jobs:
   gate:
     name: Evaluate
     # Routing only; the rules are in the script. PR events run at or above the
-    # grandfathering floor, or for PRs the gate has already labeled.
+    # grandfathering floor, or for PRs the gate has already labeled; label
+    # events only for the two labels the gate cares about.
     if: >-
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'issues' && !github.event.issue.pull_request && github.event.issue.state == 'open') ||
@@ -52,7 +54,8 @@ jobs:
           contains(github.event.pull_request.labels.*.name, 'missing-issue-link') ||
           github.event.action == 'unlabeled'
         ) &&
-        (github.event.action != 'unlabeled' || github.event.label.name == 'missing-issue-link')
+        (github.event.action != 'unlabeled' || github.event.label.name == 'missing-issue-link') &&
+        (github.event.action != 'labeled' || github.event.label.name == 'bypass-issue-check')
       )
     runs-on: ubuntu-latest
     timeout-minutes: 10

.github/workflows/shared.yml

@@ -41,6 +41,9 @@ jobs:
         with:
           extra_args: --all-files --verbose
 
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24 # match the runtime actions/github-script@v8 uses
       - name: PR intake gate scenarios
         run: node --test .github/scripts/pr_intake_gate.test.js