fix(ci): make the release gate start and pass on Windows

[wizzomafizzo]

• The first v2.17.2 tag build ended in startup_failure with no jobs run. GitHub rejected build.yml with: "Error calling workflow 'lint-and-test.yml'. The workflow is requesting 'security-events: write', but is only allowed 'security-events: none'."
• lint-and-test.yml declares security-events: write at workflow level for its govulncheck SARIF upload. The release gate job added in fix(test): unblock Windows and macOS CI, and gate releases on it #1409 calls it granting only contents, pull-requests and packages read, and GitHub validates a called workflow's declared permissions against the caller's grant before any job starts, whether or not the step that uses them will run.
• Grant security-events: write on the gate job. Nothing in a gate run uses it, because the release_gate input already skips the SARIF upload.
• With the gate running, its Windows job failed on TestScrapeLoop_AccumulatesSourceLoadFailures from fix(scraper): follow the MiSTer artwork pack format #1429. scrapeLoop formats each failed source path with %q, which escapes the backslashes in a Windows path, while the test searched the error for the raw path. The assertion now compares against strconv.Quote of the path, which is what %q produces.
• With the gate passing and every target built, Windows signing was rejected: SignPath accepts an artifact only when every job upstream of it ran in the "GitHub Actions" runner group, and the gate's Linux job runs on ubicloud-standard-4. Before fix(test): unblock Windows and macOS CI, and gate releases on it #1409 the build job had no dependency on lint-and-test.yml, so that runner was never in a release's chain. The gate now runs its Linux job on ubuntu-latest; pull requests and pushes to main keep the Ubicloud runner.
• The gate had never run on a real tag before this: fix(test): unblock Windows and macOS CI, and gate releases on it #1409 landed after v2.17.1, and the weekly build-check workflow, which calls build.yml the same way, has been failing at startup on main since 2026-08-31 for a reason not yet looked at.
• All three commits are cherry-picked from release/v2.17.2, where the v2.17.2 tag points at the last one.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 292979a4-38c2-49ef-9940-40f310c0a57d

📥 Commits

Reviewing files that changed from the base of the PR and between dc01ac2 and a7d7905.

📒 Files selected for processing (1)

• .github/workflows/build.yml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The build workflow grants security-events: write to the lint-and-test job. The change satisfies the permission contract required by the called workflow for SARIF uploads.

Changes

Workflow Permission Update

Layer / File(s)	Summary
Grant SARIF upload permission .github/workflows/build.yml	The lint-and-test job now grants security-events: write and documents the called workflow requirement.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to a7d79

The release gate now has the permission required for the reusable lint-and-test workflow to start and upload SARIF when applicable. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies a CI fix that allows the release gate to start and pass. It matches the pull request objective.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!