CI outage: arena-ai-coding-agent[bot] cannot trigger Actions workflows — every bot-triggered run startup_fails with zero jobs (org-side setting)

[arena-ai-coding-agent]

Summary

Since PRs #93/#94 were merged (2026-09-25 ~22:05), every workflow on main reports startup_failure with zero jobs — no check runs, no logs, invisible to gh pr checks. The actual error, recovered from the run-page annotation (run 36266991869):

Error: Actor is not allowed to trigger Actions workflows. Workflow file: '.github/workflows/governance.yml'.

The triggering actor of those merges — and of every PR/issue event from arena sessions — is arena-ai-coding-agent[bot], and that GitHub App is not permitted to trigger Actions workflows.

Evidence

run(s)	actor	result
all push runs at b12065e (PR #81 merge, 20:13 09-25)	hyperpolymath	ran (Hypatia/Scorecard/BoJ success; Governance/Mirror/Secret-Scanner failed at steps — i.e. CI worked)
11 × Label Triage at 21:38 09-25 (audit issues being filed)	arena-ai-coding-agent[bot]	startup_failure — including a workflow with no uses: at all
all push runs at c0f409b / db19b12 (PRs #93/#94, merged by the bot)	arena-ai-coding-agent[bot]	startup_failure
Dependabot dynamic workflow on the same commits	dependabot[bot]	success
CodeQL dynamic workflow on the same commits	(dynamic)	success
rsr-template-repo PR runs since 2026-09-24 14:33	arena-ai-coding-agent[bot]	startup_failure — same signature, so the setting is org-wide, not this repo

The b12065e-vs-21:38 flip on the same commit (Label Triage worked for owner-actor pushes at 20:13, died for bot-actor issue events at 21:38) rules out every file-level cause for the mass outage.

Consequences

• Every PR opened/updated by an arena session shows zero repo checks (the startup failure creates no check run).
• Every merge performed by the bot leaves main's CI untriggered — main has looked fully red since Fix: repair config parse errors and unblock main-branch CI #93/Ci: promote project workflows to root + strip dead praxis manifest entries #94 even though the Dependabot/CodeQL dynamic workflows on the same commits are green.
• label-triage.yml silently dies for every issue an arena session files.

Owner action (pick one)

1. Allow the App to trigger Actions — org (or repo) Settings → Actions → General → permit arena-ai-coding-agent (GitHub App) to trigger workflows; or
2. accept bot merges as CI-silent and re-run the failed workflows as the owner after each bot merge (this also verifies PR fix(ci): restore workflows from startup_failure — re-pin standards reusables to da2c748a and reconcile actions.lock #95's file fixes); or
3. stop merging via the bot (merge as the owner), which restores CI signal on every merge.

Related

• PR fix(ci): restore workflows from startup_failure — re-pin standards reusables to da2c748a and reconcile actions.lock #95 fixes the real file-level defects that existed alongside this (nonexistent governance pin, stale governance pin, actions.lock drift) — but its checks equally cannot run while the actor is blocked, so it needs an owner-actor verification trigger after merge.
• standards#968 / standards#992 document the adjacent lockfile-enforcement semantics; this issue is distinct: it is the actor gate, not the lockfile gate.