A red run notifies nobody. GitHub emails workflow failures only for
scheduled runs, so a manual dispatch of update-check, or the publish that
runs after its auto-merge, fails silently unless someone opens the Actions
tab — which is how a held-back Longbridge pin sat unnoticed.
Add scripts/ci-alert.sh: open a labelled issue for a failing key, close it
when that key succeeds again. Deduped by a hidden marker in the body rather
than by title, so a repeated daily failure keeps exactly one open issue and
never comments per run, and a renamed issue is still found.
update-check opens one alert per held-back app, naming the app and the
command to reproduce, and closes it when the payload unpacks again. Because
a hand-written fix usually carries the corrected pin too — leaving nothing
for the next run to re-verify — it also re-runs the gate for any app still
alerting; on a healthy day that costs a single `gh issue list`.
publish opens one alert on failure and closes it on the next green run.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
