gate merges on one check and isolate the release build

ci-ok aggregates every job of a CI run: it fails on any failure or
cancellation and passes when everything triggered passed or was
skipped. Branch protection requires only this one context, so
conditional jobs never need enumerating in rulesets.

The release job refuses to run outside this repository and builds
without the Actions cache: cache entries are writable from any PR
branch, so restoring one would let poisoned content reach the
publishing build.

Author: xobotyi

.github/workflows/ci.yml

@@ -69,3 +69,18 @@ jobs:
           printf '%s\n' "$out"
           [[ "$code" -ne 0 ]] || { echo "image must exit non-zero without env" >&2; exit 1; }
           grep -q GERRIT_URL <<<"$out" || { echo "error must name the missing env var" >&2; exit 1; }
+
+  # ci-ok is the single branch-protection gate: it fails when any job of the
+  # run failed or was cancelled, and passes when every triggered job passed
+  # or was skipped — so conditional jobs never need enumerating in rulesets.
+  ci-ok:
+    if: always()
+    needs: [lint, test, release-dry-run]
+    runs-on: ubuntu-latest
+    steps:
+      - name: verify all jobs succeeded
+        env:
+          RESULTS: ${{ toJSON(needs.*.result) }}
+        run: |
+          echo "$RESULTS"
+          [[ "$RESULTS" != *'"failure"'* && "$RESULTS" != *'"cancelled"'* ]]

.github/workflows/release.yml

@@ -10,6 +10,9 @@ permissions:
 
 jobs:
   release:
+    # Never run from forks or mirrors: their tags must not exercise release
+    # machinery, and nothing here may depend on another repository's state.
+    if: github.repository == 'GaijinEntertainment/go-gerrit-mcp'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -18,6 +21,10 @@ jobs:
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
+          # Release builds are hermetic: the Actions cache is writable from
+          # any PR branch, so restoring it here would let a poisoned cache
+          # entry reach the publishing build.
+          cache: false
       - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v4
       - uses: docker/login-action@v4