fix(review): fail closed before every Noema skip path

scripts/ci/noema_review_gate.py

@@ -647,24 +647,34 @@ def submit_review(repo: str, number: int, pr: dict[str, Any], actor: str, verdic
 
 
 def inspect_and_review(repo: str, number: int) -> int:
-    """Inspect PR state and submit Noema's LLM review when gates are clean."""
+    """Inspect PR state and submit Noema's LLM review when gates are clean.
+
+    Missing current-head primary OpenCode approval fails closed before every
+    Noema skip path, so the required check cannot look reviewed without an
+    exact-head Reviews API verdict.
+    """
     pr = fetch_pr(repo, number)
     actor = current_actor()
+    if not current_primary_approval(pr):
+        print(
+            "Current head does not have a primary OpenCode approval; "
+            "Noema cannot skip as success because that made the required "
+            "check look like a review."
+        )
+        return 1
     if actor in PRIMARY_REVIEW_AUTHORS:
         print(
             f"Current token actor {actor!r} is already a primary review actor; "
-            "Noema review skipped so GitHub receives an independent reviewer."
+            "Noema review skipped after the current-head primary approval so "
+            "GitHub receives an independent reviewer."
         )
         return 0
     if pr.get("isDraft"):
-        print("PR is draft; Noema review skipped.")
+        print("PR is draft; Noema review skipped after primary OpenCode approval.")
         return 0
     if existing_noema_review(pr, actor):
         print("Current head already has a Noema review; nothing to do.")
         return 0
-    if not current_primary_approval(pr):
-        print("Current head does not have a primary OpenCode approval; Noema review skipped.")
-        return 0
     if has_current_changes_requested(pr):
         print("Current head has requested changes; Noema review skipped.")
         return 0

tests/test_noema_review_gate.py

@@ -527,9 +527,21 @@ def test_inspect_and_review_skip_paths(monkeypatch):
     assert calls
 
     cases = [
-        (make_pr(), "noema"),
-        (make_pr(isDraft=True), "noema"),
-        (make_pr(reviews={"nodes": [review(login="noema", body="<!-- noema-review-gate head_sha=head -->")]}), "noema"),
+        (make_pr(isDraft=True, reviews={"nodes": [review(body=marker_body)]}), "noema"),
+        (
+            make_pr(
+                reviews={
+                    "nodes": [
+                        review(body=marker_body),
+                        review(
+                            login="noema",
+                            body="<!-- noema-review-gate head_sha=head -->",
+                        ),
+                    ]
+                }
+            ),
+            "noema",
+        ),
         (make_pr(reviews={"nodes": [review("CHANGES_REQUESTED"), review(body=marker_body)]}), "noema"),
         (make_pr(reviews={"nodes": [review(body=marker_body)]}, reviewThreads={"nodes": [{"isResolved": False, "isOutdated": False}]}), "noema"),
         (make_pr(reviews={"nodes": [review(body=marker_body)]}, statusCheckRollup={"contexts": {"nodes": [{"__typename": "StatusContext", "context": "ci", "state": "FAILURE"}]}}), "noema"),
@@ -543,6 +555,37 @@ def test_inspect_and_review_skip_paths(monkeypatch):
         assert calls == []
 
 
+@pytest.mark.parametrize(
+    ("pr", "actor"),
+    [
+        (make_pr(), "noema"),
+        (make_pr(isDraft=True), "noema"),
+        (
+            make_pr(
+                reviews={
+                    "nodes": [
+                        review(
+                            login="noema",
+                            body="<!-- noema-review-gate head_sha=head -->",
+                        )
+                    ]
+                }
+            ),
+            "noema",
+        ),
+        (make_pr(), "opencode-agent"),
+    ],
+)
+def test_noema_never_skips_success_without_current_head_primary_approval(
+    monkeypatch, pr, actor
+):
+    """Every Noema skip path remains non-passing until OpenCode approves this head."""
+    monkeypatch.setattr(noema, "fetch_pr", lambda repo, number: pr)
+    monkeypatch.setattr(noema, "current_actor", lambda: actor)
+
+    assert noema.inspect_and_review("owner/repo", 7) == 1
+
+
 def test_parse_args_and_main(monkeypatch):
     parsed = noema.parse_args(["--repo", "owner/repo", "--pr-number", "9"])
     assert parsed.repo == "owner/repo"