Bootstrap gates run on every change and before every signing or upload (D-385)

The gates were attached to publishing: they ran only as the first job of the
script publish. Holding that publish back with GitHub's skip-actions marker
dropped them together with CI, CodeQL and zizmor. The stable agent release
published the same scripts without them, the MSI build signed the loader
without them, and no gate page ever showed a run.

- pester.yml, shown as "Bootstrap script gates", runs on pushes to main as
  well as pull requests, with one list of every input of the checks.
- publish-scripts.yml: a push whose commit message carries the skip-publish
  marker (spelled out in the workflow) runs neither job and uploads nothing;
  every check of the push still runs.
- build-agent.yml: a publish_as_stable release waits for the gates, which run
  next to the build and are skipped otherwise.
- build-msi.yml: nothing is signed before the gates pass. The loader's own
  parse/ASCII step goes, since the gates cover it.
- The reusable workflow is named "Bootstrap script gates (reusable)", since
  its runs show under the caller only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/bootstrap-script-gates.yml

@@ -1,11 +1,14 @@
-name: Bootstrap script gates
+name: Bootstrap script gates (reusable)
 
 # Quality gate for the customer-facing PowerShell scripts, factored out so it exists
-# once and both callers run the identical checks:
-#   * pester.yml           -- pull requests (reports, does not block the merge button)
-#   * publish-scripts.yml  -- pushes to main, where it BLOCKS the upload to the
-#                             download alias. Devices execute these scripts as SYSTEM
-#                             during enrollment, so a red suite must never ship.
+# once and every caller runs the identical checks. Its runs show under the caller:
+#   * pester.yml           -- every pull request and push to main that changes an input
+#                             of these checks (reports, does not block the merge button)
+#   * publish-scripts.yml  -- BLOCKS the upload to the download alias
+#   * build-agent.yml      -- BLOCKS a stable release, which publishes the scripts too
+#   * build-msi.yml        -- BLOCKS signing the loader the MSI embeds
+# Devices execute these scripts as SYSTEM during enrollment, so a red suite must never
+# ship: every job that signs or uploads them waits for this workflow.
 
 on:
   workflow_call:

.github/workflows/build-agent.yml

@@ -254,6 +254,12 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+  # A stable release publishes the customer scripts as well, so it waits for the gates their
+  # own publish waits for. Next to the build; skipped when nothing goes out as stable.
+  gates:
+    if: inputs.publish_as_stable
+    uses: $/.github/workflows/bootstrap-script-gates.yml
+
   # Trust zone: only this repository's scripts, pinned actions and the pinned signing tool
   # run here -- never a restore or build. The build output arrives as data. The runner
   # image's Windows SDK signtool is used read-only, to verify third-party signatures.
@@ -263,7 +269,9 @@ jobs:
   # sign nor write storage, whatever its permissions say.
   release:
     name: Sign and publish
-    needs: [reserve, build]
+    needs: [reserve, build, gates]
+    # A skipped gates job (no stable publish) lets the release run; a failed or cancelled one stops it.
+    if: ${{ !cancelled() && needs.build.result == 'success' && (needs.gates.result == 'success' || needs.gates.result == 'skipped') }}
     runs-on: windows-latest
     environment: release
     permissions:
@@ -726,9 +734,9 @@ jobs:
             Send-Blob -Local $env:VERSIONED_ZIP -BlobName $env:STABLE_ZIP -ContentType "application/zip"
             Send-Blob -Local $env:MANIFEST_NAME -BlobName $env:STABLE_MANIFEST -ContentType "application/json"
 
-            # Customer-facing scripts: same publisher publish-scripts.yml runs on every push
-            # to main, so a release lands a set that is consistent with what is already live
-            # (dev render, version-bump guard, bootstrapVersion oracles, alias verification).
+            # Customer-facing scripts: same publisher and same gates (the gates job) as
+            # publish-scripts.yml, so a release lands a set that is consistent with what is
+            # already live (dev render, version-bump guard, bootstrapVersion oracles, alias verification).
             # Runs AFTER version.json so its bootstrapVersion read sees this build's manifest.
             # Signed with the same identity: the device-side loader verifies the publisher
             # of what it downloads, and the publisher refuses to upload unsigned scripts.

.github/workflows/build-msi.yml

@@ -34,6 +34,12 @@ env:
   CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
 
 jobs:
+  # The loader executes as SYSTEM on every enrolling device, and the MSI's custom action runs
+  # it: nothing is signed before the bootstrap gates pass on this commit, since a signed copy
+  # of ours is trusted wherever it lands.
+  gates:
+    uses: $/.github/workflows/bootstrap-script-gates.yml
+
   # Signs the loader BEFORE the build: wix embeds the file as it finds it, so a loader signed
   # afterwards would leave the copy inside the MSI unsigned. Devices under an AllSigned policy
   # need the embedded loader to carry a signature of its own.
@@ -42,6 +48,7 @@ jobs:
   # here. The `release` environment is the only subject the code-signing identity trusts.
   sign-loader:
     name: Sign bootstrap loader
+    needs: gates
     runs-on: windows-latest
     environment: release
     permissions:
@@ -59,22 +66,6 @@ jobs:
         shell: pwsh
         run: ./.github/scripts/Get-Endpoints.ps1 -ExportToGitHubEnv
 
-      # The loader executes as SYSTEM on every enrolling device — a parse error or
-      # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
-      # bootstrap-script-gates.yml runs the same checks plus Pester on pushes; this job
-      # stands on its own because it can be dispatched at any time.
-      - name: Validate runner script (parse + ASCII-only)
-        shell: pwsh
-        run: |
-          $errs = $null
-          [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $env:RUNNER_SCRIPT), [ref]$null, [ref]$errs) | Out-Null
-          if ($errs) { $errs | ForEach-Object { Write-Error $_.ToString() }; exit 1 }
-          if ((Get-Content $env:RUNNER_SCRIPT -Raw) -match '[^\x00-\x7F]') {
-            Write-Error "Runner script contains non-ASCII characters"
-            exit 1
-          }
-          Write-Host "Runner script parse + ASCII check passed"
-
       # Every published MSI is signed; a missing variable stops the run before the build.
       - name: Check code-signing configuration
         shell: pwsh

.github/workflows/pester.yml

@@ -1,25 +1,44 @@
-name: Pester (Bootstrap scripts)
+name: Bootstrap script gates
 
-# Pull-request view of the bootstrap script gates. Like ci.yml it reports rather than
-# blocks the merge button.
+# The bootstrap script gates on every change to what they execute or read, on pull requests
+# and on pushes to main, independent of any publish. Like ci.yml it reports rather than
+# blocks the merge button; what blocks is the gates job each publisher runs in front of its
+# upload.
 #
-# There is deliberately no push trigger: publish-scripts.yml runs the very same
-# reusable gate workflow on every push to main and blocks the upload to the download
-# alias on it. A push trigger here would only duplicate that run, with no consequence.
+# Both path lists are the gates' complete inputs and stay identical. They cover every push
+# path of publish-scripts.yml, which leaves the check of a [skip publish] push to this run.
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - 'scripts/Bootstrap/**'
+      - 'scripts/CustomerSetup/**'
+      - '.github/scripts/Publish-BootstrapScripts.ps1'
+      - '.github/scripts/Get-Endpoints.ps1'
+      - '.github/scripts/Invoke-BootstrapSystemPass.ps1'
+      - '.github/scripts/Test-BootstrapAttacker.ps1'
+      - '.github/workflows/bootstrap-script-gates.yml'
+      - '.github/workflows/pester.yml'
+      # The integration tests run the generated OOBE script and the MSI's custom action; the
+      # contract tests also read the MSI build.
+      - 'src/Backend/AutopilotMonitor.Functions.Tests/TestData/oobe-bootstrap-golden.ps1'
+      - 'src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs'
+      - '.github/workflows/build-msi.yml'
   pull_request:
     branches: [main]
     paths:
       - 'scripts/Bootstrap/**'
       - 'scripts/CustomerSetup/**'
       - '.github/scripts/Publish-BootstrapScripts.ps1'
+      - '.github/scripts/Get-Endpoints.ps1'
       - '.github/scripts/Invoke-BootstrapSystemPass.ps1'
       - '.github/scripts/Test-BootstrapAttacker.ps1'
       - '.github/workflows/bootstrap-script-gates.yml'
-      # The integration tests run the generated OOBE script and the MSI's command line.
+      - '.github/workflows/pester.yml'
       - 'src/Backend/AutopilotMonitor.Functions.Tests/TestData/oobe-bootstrap-golden.ps1'
       - 'src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs'
+      - '.github/workflows/build-msi.yml'
   workflow_dispatch:
 
 permissions:

.github/workflows/publish-scripts.yml

@@ -55,7 +55,12 @@ env:
 jobs:
   # $/ is the self-repository form: this repository at the running commit, never a
   # path some earlier step could have written to the workspace.
+  #
+  # A push with [skip publish] in one of its commit messages runs neither job and uploads
+  # nothing; pester.yml, whose paths cover these, still checks it. Never [skip actions] for
+  # that: it drops every check of the push, CI and these gates included.
   gates:
+    if: github.event_name != 'push' || !contains(join(github.event.commits.*.message, ' '), '[skip publish]')
     uses: $/.github/workflows/bootstrap-script-gates.yml
 
   publish: