[ac8318740]

Summary

Run version validation on label events so branch protection sees a completed check during promotion.

Promotion #413 fails with HTTP 422 because adding promote-to-main creates a newer skipped version-gate check. The earlier successful check does not keep the ref update open.

How it works

flowchart LR
    A[Label added or removed] --> B[Run unchanged version validator]
    B --> C[Promotion waits for checks]
    C --> D[Branch protection verifies checks before fast-forward]

Loading

What changed

• Remove the job condition that skips unrelated label events
• Add regression assertions for label triggers and unconditional validation
• Preserve the validator, read-only permissions, promotion authorization, and branch protection

Blast radius

• PRs into main run version validation for every configured event, including label changes
• Adds short validation runs for unrelated labels
• Changes no shipped plugin files, runtime code, dependencies, or branch rules
• Leaves existing checkout pinning and credential-persistence diagnostics unchanged

Test plan

• Regression fails before the fix and passes afterward
• bash tests/test-version-gate.sh: 41 passed
• bash tests/test-promote.sh: 30 passed
• Independent final review: no findings
• Whitespace and committed version checks
• All five feature PR CI checks pass; no review comments or AI review workflow

Post-merge verification

Rerun #413 checks and guarded promotion after this fix reaches dev, then verify the release tag. This remains unverified until that run succeeds.

No protection bypass or manual ref update is part of this change.