fix(ci): do not skip Frontend checks on isolation label events

.github/workflows/ci.yaml

@@ -4,9 +4,9 @@ on:
   pull_request:
     branches: [main, dev, staging]
     # labeled/unlabeled re-evaluate terraform-isolation when the override
-    # label is added or removed. Without them a mixed PR can keep a stale
-    # green isolation check after the label is taken off. Other jobs skip
-    # on those events so a label change does not re-run the suite.
+    # label is added or removed. Every Frontend checks job runs on those
+    # events. Skipping the suite would report required checks as success
+    # and could merge a failing SHA.
     types:
       - opened
       - synchronize
@@ -23,15 +23,12 @@ permissions:
 jobs:
   build-and-test:
     name: Build and test
-    # Skipped jobs satisfy the required checks on the unchanged SHA.
-    if: github.event_name != 'pull_request' || (github.event.action != 'labeled' && github.event.action != 'unlabeled')
     # Org reusable workflow (Node 24): format check, lint, build, unit tests.
     uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       node-version: "24"
 
   governance:
-    if: github.event_name != 'pull_request' || (github.event.action != 'labeled' && github.event.action != 'unlabeled')
     # Repo-owned guarantee that every frontend quality gate runs from this
     # repository, independent of (and in addition to) the reusable workflow.
     # `npm run verify` is the single command that chains: format check, lint
@@ -111,7 +108,6 @@ jobs:
 
   visual-regression:
     name: Visual regression
-    if: github.event_name != 'pull_request' || (github.event.action != 'labeled' && github.event.action != 'unlabeled')
     runs-on: ubuntu-latest
     container: mcr.microsoft.com/playwright:v1.61.1-noble
     steps:

QUALITY_GATES.md

@@ -53,8 +53,9 @@ and synthesis. A task is not done until this is green.
   `terraform-isolation-override` label is the only way to merge a mixed
   Terraform/application PR. `ci.yaml` runs `terraform-isolation` on
   `labeled` and `unlabeled` as well as the default pull-request types, so
-  adding or removing the label re-checks the current labels. The other CI
-  jobs skip on those events. Removing the label fails a mixed PR that had
+  adding or removing the label re-checks the current labels. The other
+  Frontend checks jobs run on those events too; skipping them would report
+  required checks as success. Removing the label fails a mixed PR that had
   previously passed with the override.
 
 ## Where the gates run

scripts/check-terraform-isolation.test.mjs

@@ -147,7 +147,7 @@ test("CLI refuses to run without a base ref or --stdin", () => {
   assert.notEqual(result.status, 0);
 });
 
-test("ci.yaml re-evaluates isolation on labeled and unlabeled and skips other jobs", () => {
+test("ci.yaml re-evaluates isolation on labeled and unlabeled without skipping other jobs", () => {
   const yaml = readFileSync(
     path.join(path.dirname(fileURLToPath(import.meta.url)), "..", ".github/workflows/ci.yaml"),
     "utf8",
@@ -156,15 +156,13 @@ test("ci.yaml re-evaluates isolation on labeled and unlabeled and skips other jo
     assert.match(yaml, new RegExp(`^      - ${eventType}$`, "m"), eventType);
   }
 
-  const skipLabelEvents =
-    /^    if: github\.event_name != 'pull_request' \|\| \(github\.event\.action != 'labeled' && github\.event\.action != 'unlabeled'\)$/gm;
-  assert.equal(
-    [...yaml.matchAll(skipLabelEvents)].length,
-    3,
-    "build-and-test, governance, and visual-regression skip label events",
+  assert.match(yaml, /^  terraform-isolation:\n/m);
+  assert.doesNotMatch(
+    yaml,
+    /github\.event\.action != 'labeled'/,
+    "skipping other jobs on label events would report required checks as success",
   );
 
   const isolation = yaml.split(/^  terraform-isolation:\n/m)[1]?.split(/^  [a-z]/m)[0] ?? "";
   assert.match(isolation, /if: github\.event_name == 'pull_request'/);
-  assert.doesNotMatch(isolation, /if: github\.event\.action != 'labeled'/);
 });

terraform/README.md

@@ -222,11 +222,10 @@ the labels. Push-to-`dev` releases return behind the repository variable
   `scripts/*terraform*` tooling are allowed alongside. A reviewer may add the
   `terraform-isolation-override` label for the rare change that must introduce
   Terraform variables together with the workflow that consumes them (PR C).
-  Adding or removing that label re-runs `terraform-isolation` against the
-  labels currently on the PR; the other CI jobs skip on those events so a
-  label change does not re-run the suite. Removing the label fails a mixed
-  PR that had previously passed with the override, so a stale green check
-  cannot merge. Markdown under `terraform/` does not count as a Terraform
+  Adding or removing that label re-runs the Frontend checks workflow,
+  including `terraform-isolation`, against the labels currently on the PR.
+  Removing the label fails a mixed PR that had previously passed with the
+  override, so a stale green check cannot merge. Markdown under `terraform/` does not count as a Terraform
   change for this gate; it does not match the workspace trigger patterns.
   The label is the approval record. The override is temporary:
   a follow-up PR after PR C removes the label path from the checker and