auto-merge-journal.yml: failure comment step never runs after validate exit 1

[Yu-0312]

Summary

Unreported workflow bug (no open PR). Field-journal auto-merge validation never posts the failure comment when a PR is blocked.

Reporter note: 先徵求作者方向，我會根據意見再開 PR。

Evidence

.github/workflows/auto-merge-journal.yml

1. Validate step on whitelist failure:
   • prints ❌ BLOCKED: ...
   • writes valid=false to $GITHUB_OUTPUT
   • exit 1 (job fails)
2. Comment step:

   - name: Comment on failure
     if: steps.validate.outputs.valid == 'false'
     run: |
       gh pr comment "$PR_NUMBER" --body "..."

GitHub Actions implies success() && <if> unless the expression includes failure() / always(). After exit 1, the comment step is skipped.

Impact

• BLOCKED field-journal PRs fail CI with no automated explanation on the PR.
• Only green PRs reach the auto-merge step; authors of rejected PRs see a red check without the intended comment body.

Proposed fix (please confirm)

- name: Comment on failure
  if: failure() && steps.validate.outputs.valid == 'false'

(or if: always() && steps.validate.outputs.valid == 'false' if you want the comment even when valid was unset)

Optional follow-up (your call): also comment when later steps fail after valid=true.

I will open a PR only after you pick failure() vs always().

Scope exclusion

• Not the content of open field-journal PRs ([field-journal] 2026-09-07 game-reverse - Famicom Namco-163 ROM static teardown #132, [field-journal] 2026-09-17 二进制/厚客户端 - Mir2 外壳+加密载荷双段结构、crib-drag 反证 #141).
• Not test-bash-workflow.sh fails on macOS: BSD sed rejects GNU-style sed -i, so Test 4/5 (case-guard reject path) never run #135 / fix(scripts): portable sed for macOS bash workflow tests #145 / feat(ida-reverse): debugger + prompt-driven ASM patch workflow #146 / feat(docker): all-in-one Docker environment #147.