CI: "CI Results" required check passes when checks or test fail (gate job is skipped) #327

The results job ("CI Results") in .github/workflows/ci.yml has needs: ["checks", "test"] and no if: condition, so GitHub applies success(). When checks or test fails, results is skipped rather than failing, and GitHub treats a skipped required check as passing.

This looks like what happened on #294: it was auto-merged while checks was failing ("29 of 30 checks passed"), which the later "Fix check errors" commit notes should not have been mergeable. In the last ~70 pull-request runs, 9 had checks failing with "CI Results" skipped.

Suggested fix

  results:
    name: "CI Results"
    needs: ["checks", "test"]
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    permissions: {}
    steps:
    - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
      run: exit 1
    - run: exit 0

!cancelled() makes the gate run (and fail) when a need fails or times out; when the whole run is cancelled, e.g. superseded by a newer push, it is still skipped. I checked the skipped-on-failure behavior in a test repository. Happy to open a PR if that's easier.