ci(env): move the CLIENT_ENV vocabulary guard into the job that gates (backend#1729)

[LukasWodka]

Summary

The vocabulary-agreement guard from #706 ran in helm-ci.yaml → job Helm lint. That job is not a required status check on this repo. The required contexts on develop are:

Unit tests · Lint · quality/gitleaks · quality/house-rules · quality/shellcheck
quality/action-pins · version-bump-gate/version-check · Source-of-truth drift

So a PR that made the four CLIENT_ENV declarations disagree was mergeable with the guard red. It advised; it did not gate.

That is backend#1729's own class, in backend#1729's own flagship deliverable — a mechanism that looks like verification but isn't connected to the outcome it claims to control.

What changed

Move the step into drift-checks.yaml → Source-of-truth drift, which needed no new configuration to make this real:

• required on develop and on main — a disagreement now blocks the merge
• no paths: on pull_request, deliberately (its header records why: a path-filtered required check bricks PRs outside those paths — docs(claude): sync org-standards block (backend#1602) #651/chore(devex): install a make check pre-push hook via make setup (backend#1606) #657/docs(#1528): document the MySQL DB identity model + edgeuser retirement (D10) #660 on 2026-08-11). So the guard now also runs on the installer-only PRs helm-ci's filter skipped entirely
• already the home of the sibling duplicated-declaration guard (check-drift.sh)
• needs only bash + python3, ~2s

helm-ci loses the step and the two paths: entries that arrived with it in #706:

entry	why
scripts/install-k8s.ps1	genuinely leaves — helm-ci is the heaviest workflow here (real k3d cluster + two 4-platform matrices); a PowerShell installer edit has no other reason to start it
scripts/lib/common.sh	also goes, but was always redundant — the pre-existing scripts/lib/** glob still matches it, so triggering is unchanged

No branch-protection change is required or included. The gate comes from landing in an already-required job.

Test plan

Mutation-proved rather than assumed:

mutation applied  (staging) → stagingXX) in scripts/lib/common.sh)
guard exit after mutation = 1
guard exit after restore  = 0

The mutation anchor was asserted to have applied before trusting the result — an inert mutation and good coverage look identical in a log.

Armed while green. On this branch all four declarations agree and every accepted spelling is exercised: dev 12, development 2, prod 11, production 4, staging 9, stg 6.

Both workflow files re-parse as valid YAML; Source-of-truth drift now lists check-drift + CLIENT_ENV vocabulary agreement.

Checklist

• Targets develop
• No new required-check contexts added (uses an existing one)
• Guard verified green before arming
• Guard verified able to go red

Refs backend#1729

---

Note

Low Risk
CI workflow wiring only; no application or chart runtime behavior changes. Effect is stronger enforcement of an existing guard via an already-required check.

Overview
Moves the CLIENT_ENV vocabulary agreement step (env-vocabulary-agreement.sh) from helm-ci’s Helm lint job into drift-checks’s Source-of-truth drift job so a mismatch across the four declarations (Go template, JSON Schema, bash, PowerShell) blocks merge instead of only failing a non-required check.

drift-checks gains the new step and header comments that position it as the home for duplicated-declaration guards and note CLIENT_ENV alongside existing drift checks. helm-ci drops that step and removes paths: entries for scripts/tests/env-vocabulary-agreement.sh, scripts/install-k8s.ps1, and the explicit scripts/lib/common.sh line (installer-only edits no longer trigger the heavy workflow; scripts/lib/** still covers common.sh).

^{Reviewed by Cursor Bugbot for commit bfa967d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bfa967d. Configure here.}

[saqlainsyed007]

Reviewed for correctness (high effort). This is a clean CI-wiring change and I recommend it.

Traced the move end-to-end:

• No coverage lost by the removed paths: entries.

  • scripts/lib/common.sh — still matched by the retained scripts/lib/** glob, so helm-ci triggering on a common.sh change is unchanged. ✓
  • scripts/install-k8s.ps1 — the PowerShell installer is exercised by installer-tests.yaml (scripts/**), windows-e2e.yaml, and release-helm-chart.yaml; helm-ci's own jobs (lint/template/unittest/ingestor-multiarch/e2e) never tested it beyond the vocabulary guard, which now runs in drift-checks. ✓
  • scripts/tests/env-vocabulary-agreement.sh — the guard itself; now runs in Source-of-truth drift, which is unfiltered on pull_request, so an edit to it still triggers the check. ✓

• The guard genuinely gates now. Source-of-truth drift is a required context and its job name is unchanged by adding a step, so branch protection keeps recognizing it — no config change needed, as the PR states.

• Runtime deps satisfied in the new home. env-vocabulary-agreement.sh needs only bash + python3 (present on ubuntu-latest) and the checked-out client/** + scripts/** sources; the drift job checks out the repo, so all four declarations and client/tests are readable. The script fails closed (exit 2) if not, which is the correct posture for a required gate.

• Both changed workflow files re-parse as valid YAML; the added step is indented consistently with check-drift.

Altitude is good: the fix lands the guard in the already-required job rather than bolting on a branch-protection special case. No correctness, cleanup, or convention issues found.