Require exact-SHA Cloud integration decisions

[sdairs]

Summary

• add a trusted controller that creates one Cloud integration decision check per exact PR head SHA
• accept only verified selected-suite success, trusted no-suite plans, or maintain/admin exact-SHA comment overrides with an audit trail
• reject stale, fork, skipped-admission, unrelated, and self-modified workflow evidence without executing PR code on write-capable controller paths
• document stacked-PR handling and wire controller tests into ordinary Cloud API CI

Tests

• python3 -m unittest discover -s scripts/tests -p 'test_*.py' (65 passed)\n- python3 -m py_compile scripts/cloud-integration-decision.py scripts/tests/test_cloud_integration_decision.py\n- cargo fmt --all --check\n- Ruby YAML parse for the changed workflows\n- git diff --check\n\n## Rollout\nDo not require the check before this stack lands on the default branch. After merge, initialize and exercise Cloud integration decision on a representative current PR, then add that GitHub Actions check to the required status checks for main; existing open PRs must first be synchronized/reopened, label-run, or explicitly overridden. Keep the on-demand Cloud Integration workflow itself informational.\n\nCloses Require an explicit Cloud integration decision before merge #410

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 79baced. Configure here.}

[cursor]

Override wiped by later reconcile

Medium Severity

reconcile always upserts the latest Cloud Integration outcome onto the exact-SHA check and never preserves an existing maintainer override. After an audited /cloud-integration-override success, a later label-triggered run that fails replaces that success with failure, so the explicit same-SHA acceptance no longer satisfies the required check.

Additional Locations (1)

• scripts/cloud-integration-decision.py#L180-L216

 

^{Reviewed by Cursor Bugbot for commit 79baced. Configure here.}

[cursor]

Null fork repo crashes controller

Low Severity

waiting_decision indexes pull_request["head"]["repo"]["full_name"] without allowing a null head.repo, which GitHub returns when the fork source was deleted. That raises during initialize, so no decision check is created. current_run_is_safe has the same footgun: .get("repo", {}) still yields None when the key is present and null.

Additional Locations (1)

• scripts/cloud-integration-decision.py#L446-L448

 

^{Reviewed by Cursor Bugbot for commit 79baced. Configure here.}