From 2be0b9266c5521884d7c19412c0f59d8e6fb957f Mon Sep 17 00:00:00 2001
From: Tianyi Cui <53024+tianyicui@users.noreply.github.com>
Date: Wed, 8 Jul 2026 10:57:25 +0800
Subject: [PATCH] ci: add all-checks-passed aggregate job for branch protection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A single stable required check that needs every other job in ci.yml, so
branch protection no longer enumerates matrix leg names that change as
lanes and node versions evolve. if: always() keeps the job running when
a dependency fails (a skipped required check would count as passing);
any non-success result — failure, cancelled, or skipped — fails it.
---
 .github/workflows/ci.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e15f344653..acb74c0c26 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,3 +128,25 @@ jobs:
 
       - name: Run compatibility gates
         run: pnpm run check:node-compat
+
+  # Single stable required check for branch protection: require "all checks
+  # passed" instead of enumerating matrix legs whose names change as lanes and
+  # node versions evolve. Every other job in THIS workflow must be listed in
+  # `needs` (`needs` cannot reach across workflow files; e2e.yml stays its own
+  # check). `if: always()` is load-bearing: without it a failed dependency
+  # would SKIP this job, and GitHub counts a skipped required check as passing
+  # — so this job always runs and fails on any non-success result, including
+  # 'cancelled' and 'skipped'.
+  all-checks-passed:
+    name: all checks passed
+    runs-on: ubuntu-latest
+    needs: [node-24, node-compat]
+    if: always()
+    steps:
+      - name: Fail if any needed job did not succeed
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
+        run: |
+          echo "::error::Needed job results: ${{ join(needs.*.result, ', ') }}"
+          exit 1
+      - name: All checks passed
+        run: echo "All needed jobs succeeded (${{ join(needs.*.result, ', ') }})"