fix(ci): ensure the release-gate-failure label exists before filing audit issue (#10389)

[aryanorastar]

Fixes #10389

What changed and why

Both break-glass audit jobs (record_break_glass in gcp_backend.yml and gcp_llm_gateway.yml) ran gh issue create --label release-gate-failure with no guarantee the label exists in the repo. GitHub rejects issue creation with an unknown label, so the audit issue was never filed — the prod Cloud Run bypass in #10301 had to be preserved manually.

Each job now runs an idempotent gh label create release-gate-failure (suppressed on "already exists") before filing the issue, so the audit trail can no longer be dropped by a missing label.

Product invariants affected

None (CI workflow only).

How it was verified

• actionlint .github/workflows/gcp_backend.yml — clean.
• actionlint .github/workflows/gcp_llm_gateway.yml — no new findings (the SC2086 warnings are pre-existing on main, in an untouched step).
• python3 .github/scripts/check-direct-backend-production-admission.py — passes (the static release-gate-failure fragment requirement is still satisfied).

Tests

No test change — this is a workflow runtime behavior fix. The static break-glass contract check (check-direct-backend-production-admission.py) still passes and continues to require the audit path to reference the label.

Failure class (fixes)

Failure-Class: none

Scoped cleanups

None.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[Git-on-my-level]

Thanks for tightening this up. I reviewed the current head after the earlier Cubic feedback: the new label_output handling now only tolerates the explicit "already exists" case and fails loudly for other gh label create errors, so the audit issue is no longer silently dropped on permission/API/rate-limit failures.

I also checked the workflow permissions around both record_break_glass jobs (issues: write) and ran the static backend production admission contract script against the PR head; it passes. A small shell-behavior check for the added conditional also behaved as intended for success, already-exists, and fatal-error cases.

Because this touches release/deploy workflow behavior, I’m leaving this as a positive signal rather than formal approval and tagging it for maintainer workflow review before merge.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[aryanorastar]

@Git-on-my-level need human response — this is still blocked on code-owner review for release/deploy workflow automation.

Your earlier AI pass was a positive signal (not CHANGES_REQUESTED): label_output only tolerates the explicit "already exists" case and fails loudly on permission/API/rate-limit errors; both record_break_glass jobs have issues: write; static backend production admission contract passes. Current head da343378 is CI green (cubic issues already addressed).

What’s left is the formal human / workflow-review sign-off, or an explicit hold if something else is blocking. Happy to follow up immediately either way.

[aryanorastar]

@Git-on-my-level need human response — release/deploy workflow code-owner APPROVE still the only merge blocker on #10966.

Refreshed tip 8418d84b = merge of current main onto the break-glass label ensure fix (no conflicts). Still:

• idempotent gh label create release-gate-failure before audit issue create (both gcp_backend.yml + gcp_llm_gateway.yml)
• only tolerates explicit “already exists”; other errors fail loudly
• Failure-Class: none

Static check-direct-backend-production-admission.py still passes on this tip. Your earlier AI pass was positive. Please human / workflow-review APPROVE (or explicit hold) when you can.

[aryanorastar]

@Git-on-my-level workflow-review ping: current head is MERGEABLE and CI evidence is green. The release-gate-failure label guard has no author-side blocker; please approve or state an explicit hold.

[aryanorastar]

@Git-on-my-level @undivisible review ping — this one is ready and has been waiting 4 days.

MERGEABLE, no failing checks on the current head. It ensures the release-gate-failure label exists before the audit issue is filed (#10389).

Blocked only on workflow CODEOWNER approval — .github/workflows/** requires your sign-off per CODEOWNERS, so I can't move it myself.

---

_{Still current and still author-side clear. Verified against main on 2026-08-23: not superseded, still MERGEABLE, all checks green, no conflicts. Blocker is the CODEOWNERS workflow-review routing. Grouped with six sibling CI PRs in one consolidated ping at #10959 rather than bumping each thread separately.}