From d5bd6702cfb6b6ad851a12cc79725670ed2d8bde Mon Sep 17 00:00:00 2001
From: Myron Marston <myron@squareup.com>
Date: Fri, 1 Nov 2024 14:39:37 -0700
Subject: [PATCH] Provide a summary status of the CI build that we can block
 merges on.

---
 .github/workflows/ci.yaml | 21 ++++++++++++++++++++-
 script/update_ci_yaml     | 21 ++++++++++++++++++++-
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 43688089..9493bdd3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -17,7 +17,7 @@ env:
   NO_VCR: "1"
 
 jobs:
-  test:
+  ci-check:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -66,3 +66,22 @@ jobs:
       # We've found that there is a minor race condition where the shards aren't fully ready for the tests
       # to hit them if we don't wait a bit after booting.
       - run: script/ci_parts/${{ matrix.build_part }} ${{ matrix.datastore }} 10
+
+  # An extra job that runs after all the others and provides a single summary status.
+  # This is used by our branch protection rule to block merge until all CI checks passed,
+  # without requiring us to individually list each CI check in the branch protection rule.
+  #
+  # https://github.com/orgs/community/discussions/26822#discussioncomment-3305794
+  all-ci-checks-passed:
+    if: ${{ always() }} # so it runs even if the workflow was cancelled
+    runs-on: ubuntu-latest
+    name: All CI Checks Passed
+    needs: [ci-check]
+    steps:
+      - run: |
+          result="${{ needs.ci-check.result }}"
+          if [[ $result == "success" || $result == "skipped" ]]; then
+            exit 0
+          else
+            exit 1
+          fi
diff --git a/script/update_ci_yaml b/script/update_ci_yaml
index a254243e..d012013d 100755
--- a/script/update_ci_yaml
+++ b/script/update_ci_yaml
@@ -99,7 +99,7 @@ env:
   NO_VCR: "1"
 
 jobs:
-  test:
+  ci-check:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -148,3 +148,22 @@ jobs:
       # We've found that there is a minor race condition where the shards aren't fully ready for the tests
       # to hit them if we don't wait a bit after booting.
       - run: script/ci_parts/${{ matrix.build_part }} ${{ matrix.datastore }} 10
+
+  # An extra job that runs after all the others and provides a single summary status.
+  # This is used by our branch protection rule to block merge until all CI checks passed,
+  # without requiring us to individually list each CI check in the branch protection rule.
+  #
+  # https://github.com/orgs/community/discussions/26822#discussioncomment-3305794
+  all-ci-checks-passed:
+    if: ${{ always() }} # so it runs even if the workflow was cancelled
+    runs-on: ubuntu-latest
+    name: All CI Checks Passed
+    needs: [ci-check]
+    steps:
+      - run: |
+          result="${{ needs.ci-check.result }}"
+          if [[ $result == "success" || $result == "skipped" ]]; then
+            exit 0
+          else
+            exit 1
+          fi