Merge pull request #10 from nickroci/ci/ci-success-gate

ci: add ci-success aggregate gate

Author: nickroci

.github/workflows/ci.yml

@@ -48,3 +48,21 @@ jobs:
 
       - name: Tests (pytest)
         run: uv run pytest
+
+  ci-success:
+    # Single required check for branch protection. It goes green only when
+    # every job above has succeeded, so protection on `main` can require
+    # just this one context — adding/removing CI jobs never means editing
+    # the protection settings. `if: always()` makes it run (and report
+    # red) even when `build` fails or is cancelled, so it can't be skipped
+    # past a failing matrix.
+    name: ci-success
+    if: always()
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all CI jobs to have passed
+        run: |
+          result="${{ needs.build.result }}"
+          echo "build matrix result: $result"
+          test "$result" = "success"