Fix summary for aw check requirements (#174160)

.github/workflows/check-requirements.md

@@ -164,6 +164,9 @@ Read the JSON directly for the full schema. Key fields:
   - `{{CHECK_DETAIL:<pkg>:<kind>}}` → `<icon> <one-line explanation>`
     (the bullet's `- **<label>**:` prefix is already rendered; replace
     only the placeholder).
+  - `{{SUMMARY}}` → the single top-of-comment summary line, present only
+    when at least one check needed resolving. Fill it **after** resolving
+    every check, based on the final cell verdicts (see Step 3).
 
 Do not modify other content in `rendered_comment`, do not re-evaluate
 deterministic checks, do not add or remove packages. If `needs_agent`
@@ -192,6 +195,13 @@ Replace every placeholder with the resolved value and emit
 `<!-- requirements-check -->` marker. The PR target is already wired;
 do not pass `item_number`.
 
+If a `{{SUMMARY}}` placeholder is present, replace it last, once every
+`{{CHECK_CELL:…}}` is resolved:
+- `All requirements checks passed. ✅` — when every check cell across all
+  packages is `✅` or `☑️` (treat `—`/skipped as not a problem).
+- `⚠️ Some checks require attention — see the details below.` — when any
+  cell is `⚠️` or `❌`.
+
 ## Check instructions
 
 ### Check kind: `repo_public`

script/check_requirements/render.py

@@ -34,6 +34,14 @@ _ICONS: dict[CheckStatus, str] = {
 }
 SKIPPED = "—"
 
+SUMMARY_PASS = "All requirements checks passed. ✅"
+SUMMARY_ATTENTION = "⚠️ Some checks require attention — see the details below."
+# Emitted when at least one check still needs the agent. The agent resolves it
+# to one of the two lines above once it has replaced the cell/detail
+# placeholders, so the summary reflects the final verdicts rather than the
+# deterministic-stage state.
+SUMMARY_PLACEHOLDER = "{{SUMMARY}}"
+
 
 def _placeholder(slot: str, pkg: PackageChange, kind: CheckKind) -> str:
     """Placeholder marker the agent replaces before posting."""
@@ -57,9 +65,12 @@ def _overall_status(pkg: PackageChange) -> CheckStatus | None:
 
 
 def _summary_line(packages: list[PackageChange]) -> str:
-    if all(_overall_status(p) == CheckStatus.PASS for p in packages):
-        return "All requirements checks passed. ✅"
-    return "⚠️ Some checks require attention — see the details below."
+    statuses = [_overall_status(p) for p in packages]
+    if None in statuses:
+        return SUMMARY_PLACEHOLDER
+    if all(status == CheckStatus.PASS for status in statuses):
+        return SUMMARY_PASS
+    return SUMMARY_ATTENTION
 
 
 def _cell(pkg: PackageChange, kind: CheckKind) -> str:

tests/scripts/check_requirements/test_render.py

@@ -66,6 +66,51 @@ def test_render_needs_agent_emits_generic_placeholders() -> None:
     assert "{{CHECK_CELL:pkg:async_blocking}}" in rendered
     assert "{{CHECK_DETAIL:pkg:async_blocking}}" in rendered
     assert "<details open>" in rendered
+    # A deterministic WARN (CI_UPLOAD) already forces the attention verdict
+    # regardless of how the agent resolves the pending checks, so the summary
+    # is rendered directly rather than deferred to the agent.
+    assert "⚠️ Some checks require attention — see the details below." in rendered
+    assert "{{SUMMARY}}" not in rendered
+
+
+def test_render_pass_or_pending_defers_summary_to_agent() -> None:
+    """With only PASS and NEEDS_AGENT checks, the summary is left as a placeholder.
+
+    The final verdict depends entirely on how the agent resolves the pending
+    checks, so the deterministic stage must not bake in a summary line.
+    """
+    pkg = PackageChange(
+        name="pkg",
+        old_version=None,
+        new_version="1.0.0",
+        repo_url="https://github.com/x/pkg",
+        checks={
+            CheckKind.CI_UPLOAD: _pass("attestation found"),
+            CheckKind.SECURITY: CheckResult(CheckStatus.NEEDS_AGENT, ""),
+            CheckKind.ASYNC_BLOCKING: CheckResult(CheckStatus.NEEDS_AGENT, ""),
+        },
+    )
+    rendered = render_comment(CheckRunResult(pr_number=1, packages=[pkg]))
+    assert "{{SUMMARY}}" in rendered
+    assert "All requirements checks passed. ✅" not in rendered
+    assert "⚠️ Some checks require attention" not in rendered
+
+
+def test_render_deterministic_warn_renders_attention_summary() -> None:
+    """A WARN with no agent-pending checks renders the attention line directly."""
+    pkg = PackageChange(
+        name="pkg",
+        old_version="1.0.0",
+        new_version="1.1.0",
+        repo_url="https://github.com/x/pkg",
+        checks={
+            CheckKind.CI_UPLOAD: _pass("attestation found"),
+            CheckKind.SECURITY: CheckResult(CheckStatus.WARN, "partial scan"),
+        },
+    )
+    rendered = render_comment(CheckRunResult(pr_number=1, packages=[pkg]))
+    assert "⚠️ Some checks require attention — see the details below." in rendered
+    assert "{{SUMMARY}}" not in rendered
 
 
 def test_render_empty_change_set() -> None: