ci: open issues for unattended scheduled gate failures

.github/workflows/gate-failure-watch.yml

@@ -0,0 +1,88 @@
+name: Scheduled Gate Failure Watch
+
+# A completed red gate on main is not an alert by itself: #9830 measured one
+# correctly failing scheduled workflow that stayed red for nineteen days. This
+# observer turns that result into one durable issue per workflow. Repeated reds
+# update the same issue with the current rows and their delta; the next green
+# closes it.
+
+on:
+  workflow_run:
+    workflows:
+      - Auto-Optimize App Patterns
+      - CI
+      - Gate Freshness
+      - GC Moving Witnesses
+      - gc-native-roots
+      - GC Parse-Churn Layout Gate
+      - GC Ptr<Shape> OFF-arm witness
+      - GC Ratchet
+      - GC Root Dominance
+      - TLS Budget
+      - eh-transport
+      - llvm-inprocess
+    types: [completed]
+  pull_request:
+    paths:
+      - .github/workflows/*.yml
+      - scripts/gate_failure_watch.json
+      - scripts/gate_failure_watch.py
+      - scripts/gate_freshness.json
+
+permissions:
+  contents: read
+
+concurrency:
+  group: scheduled-gate-failure-watch-${{ github.event_name == 'workflow_run' && github.event.workflow_run.id || github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Self-test the failure observer
+        run: python3 scripts/gate_failure_watch.py --self-test
+      - name: Check watched-workflow configuration
+        run: python3 scripts/gate_failure_watch.py --check-config
+
+  observe:
+    if: >-
+      github.event_name == 'workflow_run' &&
+      (
+        github.event.workflow_run.event == 'schedule' ||
+        (
+          (github.event.workflow_run.event == 'workflow_dispatch' ||
+           github.event.workflow_run.event == 'repository_dispatch') &&
+          github.event.workflow_run.head_branch == 'main'
+        ) ||
+        (
+          github.event.workflow_run.event == 'push' &&
+          (github.event.workflow_run.head_branch == 'main' ||
+           startsWith(github.event.workflow_run.head_branch, 'v'))
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+    steps:
+      # workflow_run carries a write-capable token. Execute only the trusted
+      # default-branch script, never the triggering workflow's checkout.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: main
+          persist-credentials: false
+      - name: Open, update, or close the workflow's failure issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: python3 scripts/gate_failure_watch.py

docs/src/testing/ci-gate-scheduling.md

@@ -215,6 +215,30 @@ queued/in-progress/cancelled runs, and a gate whose only recent results are
 its `main` arm was dark), and asserts the verdict for each. A green `--self-test`
 means the detector works, not that nothing was tried.
 
+## A completed red gate must create work (#9830)
+
+Fresh execution is only half of the contract. A scheduled gate can run, fail
+correctly, and stay red in the Actions list without anyone owning the failure.
+`gate-failure-watch.yml` observes the completed post-merge workflows in
+`scripts/gate_failure_watch.json` and maintains one issue per failing workflow.
+The issue records the run URL, head SHA, failed job/step rows, the rows added or
+removed since the previous failure, and the last green main SHA. Repeated failures
+update the same issue; the next green run comments and closes it.
+
+The observer accepts scheduled and main-branch dispatch runs, main pushes, and
+release-tag pushes. It ignores pull-request and feature-branch runs. Its
+`workflow_run` job has `issues: write`, so it always checks out the trusted `main`
+copy of the script; pull requests run only the offline self-test and configuration
+check with read-only permissions.
+
+When adding or renaming a post-merge gate, update `gate_failure_watch.json` and the
+observer's `workflow_run.workflows` list together. The configuration check also
+requires every workflow tracked by `gate_freshness.json` to be watched or explicitly
+excluded with a reason.
+
+For every gate, ask: if this fails on `main` tonight, who finds out, and how? A run
+visible only in the Actions list has no owner.
+
 ## The queue in front of the schedule (#7966)
 
 A six-hourly sweep only helps if the queue drains faster than six hours. On

scripts/gate_failure_watch.json

@@ -0,0 +1,24 @@
+{
+  "default_branch": "main",
+  "tag_pattern": "^v[0-9]",
+  "workflows": [
+    { "path": "auto-opt-app-patterns.yml", "name": "Auto-Optimize App Patterns" },
+    { "path": "eh-transport.yml", "name": "eh-transport" },
+    { "path": "gate-freshness.yml", "name": "Gate Freshness" },
+    { "path": "gc-moving-witnesses.yml", "name": "GC Moving Witnesses" },
+    { "path": "gc-native-roots.yml", "name": "gc-native-roots" },
+    { "path": "gc-parse-churn-gate.yml", "name": "GC Parse-Churn Layout Gate" },
+    { "path": "gc-ptr-shape-off-witness.yml", "name": "GC Ptr<Shape> OFF-arm witness" },
+    { "path": "gc-ratchet.yml", "name": "GC Ratchet" },
+    { "path": "gc-root-dominance.yml", "name": "GC Root Dominance" },
+    { "path": "llvm-inprocess.yml", "name": "llvm-inprocess" },
+    { "path": "test.yml", "name": "CI" },
+    { "path": "tls-budget.yml", "name": "TLS Budget" }
+  ],
+  "excluded": [
+    {
+      "path": "npm-publish-freshness.yml",
+      "why": "This workflow already maintains its own sticky failure issue."
+    }
+  ]
+}