From b88fadb0390d2113933d5d155f16b07cbd5dafee Mon Sep 17 00:00:00 2001
From: Dotta <34892728+cryppadotta@users.noreply.github.com>
Date: Fri, 28 Aug 2026 11:22:05 -0500
Subject: [PATCH] fix(ci): emit one runner route (#12444)

## Summary

- emit exactly one `runner` job output from the trusted gate
- write `ubuntu-latest` only inside fail-closed paths
- write the Fleet label only after every identity, PR-state,
merge-equivalence, and rerun-actor check passes

## Canary finding

The live gate reached the trusted success notice, but GitHub retained
the first of two duplicate `runner=` outputs, so policy still requested
`ubuntu-latest`. No EC2 instance launched. Routing was disabled
immediately.

## Validation

- `actionlint .github/workflows/pr-trusted.yml .github/workflows/pr.yml`
- `node --test ./scripts/__tests__/e2e-shard.test.mjs`
- internal routing harness passes and now requires exactly one runner
output in all cases
- AWS routing remains disabled during rotation
---
 .github/workflows/pr-trusted.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr-trusted.yml b/.github/workflows/pr-trusted.yml
index 30fc834655..2ca460b4bd 100644
--- a/.github/workflows/pr-trusted.yml
+++ b/.github/workflows/pr-trusted.yml
@@ -49,9 +49,9 @@ jobs:
 
           github_runner='ubuntu-latest'
           aws_runner='runs-on/fleet=paperclip-public-pr-x64/env=public-ci'
-          echo "runner=$github_runner" >> "$GITHUB_OUTPUT"
 
           fail_closed() {
+            echo "runner=$github_runner" >> "$GITHUB_OUTPUT"
             echo "::notice title=AWS CI routing::Using GitHub-hosted runner: $1"
             exit 0
           }