API Review Gate blocks every open PR whose merge-base predates cmd/api-gate #3192

The API Review Gate required check (.github/workflows/api-review-gate.yaml) fails on every open PR whose merge-base with main predates the gate's own landing commit (fa871249c, 2026-07-01), and it fails before evaluating any API content. This currently red-blocks the entire pre-gate open-PR backlog.

Mechanism

The "Materialize base checkout at the merge base" step builds the detector from git merge-base(head, origin/main) rather than the main tip — intentional, to avoid base-drift inventing or hiding API findings. The "Build api-gate" step then does:

if [ -d "${RUNNER_TEMP}/base/cmd/api-gate" ]; then
  build_dir="${RUNNER_TEMP}/base"          # trusted base
else
  build_dir="${GITHUB_WORKSPACE}"          # head fallback (bootstrap)
fi
( cd "${build_dir}" && go build -o "${RUNNER_TEMP}/api-gate" ./cmd/api-gate )

For any PR whose merge-base is older than fa871249c, cmd/api-gate exists in neither the merge-base checkout nor the (equally old) PR head, so the build fails:

##[warning]api-gate not present on the base branch yet; building from head (bootstrap)...
stat .../cmd/api-gate: directory not found
##[error]Process completed with exit code 1

The check reports FAILURE before any API detection runs.

Evidence

• A non-API PR that only adds a container resources block ([kubernetes] Add CPU/memory limits to csi-resizer sidecar #2614) fails the gate with every other check green — so it is not gating on API content, it is failing to build.
• PRs branched after 2026-07-01 (e.g. fix(ci): catch templated CRDs and APIService-only groups in the API gate #3184, fix(operator): force source-watcher drift on stuck ArtifactGenerator status #3182, fix(vertical-pod-autoscaler): migrate admission-controller TLS to cert-manager to stop reconcile-driven ReplicaSet churn #3178, fix(kubernetes): parallel worker VM provisioning on tenant cluster create #3177) pass the gate.
• The gate re-triggers on pull_request_review, so an approving review re-runs it and it re-fails from the same old merge-base — neither a review nor a plain re-run clears it.

Impact

Every open PR created before 2026-07-01 is blocked on this required check regardless of what it changes. The only per-PR workaround is a rebase onto current main, which moves the merge-base past fa871249c — a lot of manual toil across the whole backlog.

Suggested fix

When cmd/api-gate is absent from the merge-base checkout, fall back to building the detector from the main tip (or a pinned trusted ref) instead of the PR head. The head fallback only helps during the bootstrap window before the tool exists anywhere, which has already passed, so it can no longer succeed. Building from main tip when the merge-base lacks the tool would unblock the backlog without requiring every open PR to rebase, while keeping the "analyze head as data, not code" property. This is distinct from #3184, which addresses detection false-negatives rather than this build failure.