[chaodu-obk]

What problem does this solve?

pre-beta-build.yml is scheduled hourly, and its gate builds only if main got a commit in the last ~70 minutes. In practice GitHub delivers this schedule only every ~4–5 hours (100 runs between 2026-10-01 and 2026-10-23), so most merges fall outside the window and never get built.

Evidence:

• ghcr.io/openabdev/openab:pre-beta-* was last built on 2026-10-03 from 99c11ec (fix(pool): keep the [[ws:]] workspace across hung eviction #1557). docs(cron): document cron autonomy and permission scope #1562, fix(cron)!: treat blank thread_id/id as unset; document thread_id/id behavior #1564, release: v0.10.0-beta.6 #1568 and ci(release): include a Review Contract in generated release PRs #1569 never reached pre-beta.
• As a result, pre-beta-<agent> still ships Node 22.23.3, which misses the October Node.js security release (RFC: rebuild agent images for Node.js security releases (Node 22.23.4 / 24.22.1) #1567). openab-pty builds every image, nightly included, FROM openab:pre-beta-<variant>, so all published openab-pty images are on 22.23.3 too.

A manual full rebuild was dispatched separately (run 39886364920). This PR fixes the gate so the drift does not come back.

Discord Discussion URL: https://discord.com/channels/1490282656913559673/1562951633544020000

Review Contract

Goal

A scheduled pre-beta run builds whenever main HEAD has not yet been published by a full pre-beta build, no matter how late GitHub delivers the schedule.

Non-goals

• No change to workflow_dispatch behavior: manual runs still always build.
• No change to the build, tag, or oabctl jobs, or to the cron expression.
• No rebuild trigger for base-image changes when main is unchanged. That is covered by the daily Node security check (chore(ci): add daily node-security-check workflow #1571) and the nightly lane.

Accepted Residual Risks

• Finding the last full build costs one jobs-API call per recent successful run, until a run that tagged every agent is found. Today that is 92 calls, because the last full build is 3 weeks old. In steady state it is a handful of calls, well within GITHUB_TOKEN limits.
• If one agent fails to build, the run is not success. The next scheduled run then rebuilds all agents, and this repeats until the failure is fixed. This is intentional: a red pre-beta should be retried, not silently skipped.
• A partial manual build (an agents subset) does not count as a full build, so the next scheduled run rebuilds everything once.

Acceptance Criteria

• A scheduled run with main HEAD equal to the head SHA of the last full pre-beta build logs should_run=false and skips the build.
• A scheduled run with a newer main HEAD logs should_run=true and builds, even when the last commit is older than 70 minutes.
• workflow_dispatch always builds.
• The gate job has only contents: read and actions: read.

Follow-ups

• After merge, confirm the next scheduled run logs last full pre-beta build <sha> and makes the correct decision.
• chore(ci): add daily node-security-check workflow #1571: the daily check should also cover pre-beta-* and downstream openab-pty images.

How the new gate works

1. Read the default-branch HEAD SHA.
2. List successful pre-beta-build.yml runs on that branch, newest first. Take the first run whose tag (<agent>) jobs succeeded for every agent in ALL_AGENTS. Skipped-gate runs and partial builds are ignored.
3. Build if that run's head_sha differs from HEAD.

Validation

• node --check passes on the extracted github-script body. It was checked with Node 22.23.4, downloaded and verified against the official SHASUMS256.
• The extracted script was run against the live API with a small Octokit shim (eventName=schedule):

  INFO main HEAD 2e7d189857abd57f9657bf45e959ff5e97bc8473, last full pre-beta build 99c11ec10e239c4054c304efee6b99204ac6440a -> should_run=true
  jobs API calls: 92
  

  This matches the image creation date of pre-beta-* (2026-10-03).
• Not verified: YAML parsing with actionlint, and a real scheduled run. The schedule only runs from main.