fix: restrict cross-repo release gate token to push

[YoneRai12]

Motivation

• Pull request builds for the quality-wall workflow injected secrets.YONERAI_RELEASE_GATE_TOKEN into GH_TOKEN and then executed scripts/yonerai_release_gate.py from the checked-out PR workspace, allowing a same-repo PR to exfiltrate a cross-repo secret.
• The change aims to prevent PR-controlled code from receiving repository secrets while preserving the existing cross-repo gate for trusted push snapshots.

Description

• Added an execution guard if: ${{ github.event_name == 'push' }} to the Run v0.23 cross-repo release gate snapshot step in /.github/workflows/quality-wall.yml so the step only runs on push events.
• Kept the existing env wiring and the python scripts/yonerai_release_gate.py --release-issue 592 command intact for trusted push snapshots.
• Added a regression test test_cross_repo_release_gate_token_is_not_exposed_to_pull_request_code to tests/test_quality_wall_workflow.py which loads the workflow YAML and asserts the step is push-only and its GH_TOKEN and run contents remain as intended.
• No other workflow steps or runtime/source code paths were modified and src/cogs/ora.py and reference_clawdbot were not edited.

Testing

• Ran python -m pytest tests/test_quality_wall_workflow.py -q and the test suite containing the new assertion passed.
• Ran python -m compileall scripts tests/test_quality_wall_workflow.py and the affected scripts compiled successfully.
• Ran python scripts/ci_quality_scans.py --changed and ruff check tests/test_quality_wall_workflow.py and both static checks passed.
• Performed a hidden-Unicode/mojibake scan on changed files and found no issues.

---

Codex Task

[gemini-code-assist]

Code Review

This pull request introduces a new test, test_cross_repo_release_gate_token_is_not_exposed_to_pull_request_code, to verify that the cross-repo release gate token is not exposed to pull request code in the quality wall workflow. The feedback recommends improving the test's error reporting by providing a default value to the next() function when locating the target workflow step, which avoids an uninformative StopIteration exception if the step is not found.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Using next() on a generator expression without a default value will raise a StopIteration exception if the step is not found. In a test environment, this results in an uninformative test error rather than a clear assertion failure. Providing a default value of None and asserting that the step is not None makes the test failure much more diagnostic and easier to debug.

Suggested change

	cross_repo_gate_step = next(
	step
	for step in release_gate_steps
	if step.get("name") == "Run v0.23 cross-repo release gate snapshot"
	)
	cross_repo_gate_step = next(
	(step for step in release_gate_steps if step.get("name") == "Run v0.23 cross-repo release gate snapshot"),
	None,
	)
	assert cross_repo_gate_step is not None, "Step 'Run v0.23 cross-repo release gate snapshot' not found in workflow"

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 863ac281d2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add the PyYAML dependency or avoid the yaml import

In the checked release-gate workflow path, dependencies are installed with python -m pip install -e clients/cli pytest, and neither that package nor the requirements used by this job declare PyYAML; this new top-level import makes python -m pytest tests/test_quality_wall_workflow.py -q fail during collection with ModuleNotFoundError: No module named 'yaml'. Please either keep this test on stdlib/string checks or install/declare PyYAML for the job that runs it.

Useful? React with 👍 / 👎.