From 30efd6cb1ea3645d72de424eb46c4244259cbf3f Mon Sep 17 00:00:00 2001 From: Armando Navarro Date: Thu, 5 Nov 2026 12:14:41 -0800 Subject: [PATCH] ci: fail the Branch protection check when a job it waits on does not succeed The job is main's required status check. Without an if: it was skipped whenever test, contribute, browser or firebase-13 failed, and GitHub counts a skipped required check as satisfied, so a pull request with red tests stayed mergeable. Now the job always runs and exits 1 unless every needed job succeeded. skipped is included because a failed build skips three of the four jobs rather than failing them, and always() rather than !cancelled() because a cancelled run must also leave the check red. Found by Tyler Reitz on #3762. --- .github/workflows/test.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 568664f05..6d5b054d8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -193,8 +193,13 @@ jobs: runs-on: ubuntu-latest name: Branch protection needs: ['test', 'contribute', 'browser', 'firebase-13'] + # A skipped job satisfies a required status check, so this job must run on every outcome of + # the jobs above and fail itself. Keep always(), not !cancelled(): a cancelled run must stay red. + if: ${{ always() }} steps: - - run: true + - name: Fail unless every needed job succeeded + if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }} + run: exit 1 publish: runs-on: ubuntu-latest