fix: publish automation PR statuses

[loadinglucian]

Adds GitHub commit statuses for the required contexts only after the exact-head dispatched CI and Protected controls validators pass. Retains the Actions check-run evidence and validator URLs, then waits for the PR rollup before ordinary merge.\n\nVerified: php-bin 18 tests; cross-repository A00-A20 digest sha256:965a10409c051cf22d6864c86c91e6ca58c440779c5690d37e1098a758fee568.

Summary by CodeRabbit

• Enhancements

  • Required validation results now publish clear, per-check commit statuses linked to the exact validator details.
  • Pull requests receive more reliable visibility into successful automated checks.

• Documentation

  • Updated maintenance guidance to clarify how automated check evidence appears in pull requests and connects to validator URLs.

• Reliability

  • Improved workflow access ensures validation statuses can be reported consistently across maintenance and release processes.

[coderabbitai]

📝 Walkthrough

Walkthrough

The maintenance check dispatcher now publishes successful per-validator commit statuses for the exact PR head SHA, using validator names and URLs. Three maintenance workflows grant statuses: write, documentation reflects the status behavior, and tests verify the integration.

Changes

Maintenance status publication

Layer / File(s)	Summary
Publish validator commit statuses scripts/dispatch-pr-checks, docs/repository-settings.md	The dispatcher posts successful statuses for both validators with their details URLs, and repository requirements describe the resulting PR-visible status evidence.
Grant status permissions and validate integration .github/workflows/maintenance-implementation.yml, .github/workflows/maintenance-release.yml, .github/workflows/maintenance-watch.yml, tests/test_maintenance.py	Maintenance workflows add statuses: write, while tests verify the statuses API path and workflow permissions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Bigpixelrocket/php-bin#32: Updates maintenance workflows around the same dispatch-pr-checks automation flow.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the change, but it does not follow the required template and omits Verification and Security/licensing sections.	Rewrite it with the required Summary, Verification, and Security and licensing sections, and include the checklist items the template asks for.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately describes the main change: publishing automation PR statuses.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/publish-automation-statuses

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

tests/test_maintenance.py (1)

289-301: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Assert the status payload and success-path ordering, not only substrings.

These checks can pass even if the dispatcher uses the wrong state, context, or target_url, or publishes statuses before both validators pass. Add assertions covering the success payload fields and their placement after both publish_gate calls.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_maintenance.py` around lines 289 - 301, Strengthen the maintenance
workflow tests around the dispatcher assertions by verifying the success status
payload uses the expected state, context, and target_url values. Also assert
that the status publication occurs only after both validator publish_gate calls,
preserving the required success-path ordering rather than relying solely on
substring checks.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@tests/test_maintenance.py`:
- Around line 289-301: Strengthen the maintenance workflow tests around the
dispatcher assertions by verifying the success status payload uses the expected
state, context, and target_url values. Also assert that the status publication
occurs only after both validator publish_gate calls, preserving the required
success-path ordering rather than relying solely on substring checks.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c570d3c6-3be6-4380-b972-c4c17a0a7a73

📥 Commits

Reviewing files that changed from the base of the PR and between 5e41fd6 and 941e5e0.

📒 Files selected for processing (6)

• .github/workflows/maintenance-implementation.yml
• .github/workflows/maintenance-release.yml
• .github/workflows/maintenance-watch.yml
• docs/repository-settings.md
• scripts/dispatch-pr-checks
• tests/test_maintenance.py