From 594438eaaba63e914ee7f7b4e2b3ae6a7e1145e0 Mon Sep 17 00:00:00 2001
From: Alexey Shalaev <75322386+AlexeyShalaev@users.noreply.github.com>
Date: Fri, 16 Oct 2026 18:40:10 +0400
Subject: [PATCH] fix: the generated gate fails when a needed job was skipped

The All checks passed job failed only on failure or cancelled, so a job that
ended skipped counted as passed. Today that takes a failed lint, which already
fails the gate, but an if: or a paths filter added to the test jobs later would
turn "the tests did not run" into a green required check.

Every needed job now has to succeed. A job skipped by design is named in
MAY_SKIP, and only those may end skipped. The template's own CI already
requires success from every job; the generated one now does too, without
breaking a library that skips a job on purpose.

Closes #16
---
 template/.github/workflows/ci.yml.jinja | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/template/.github/workflows/ci.yml.jinja b/template/.github/workflows/ci.yml.jinja
index e212ca7..cd15e68 100644
--- a/template/.github/workflows/ci.yml.jinja
+++ b/template/.github/workflows/ci.yml.jinja
@@ -56,7 +56,10 @@ jobs:
           set -e
           test $STATUS -eq 0 -o $STATUS -eq 5
 
-  # Sentinel job — use this as the single required status check in branch protection.
+  # Sentinel job — the single required status check in the master ruleset. A job
+  # counts only when it succeeded: "skipped" means the work did not happen. A job
+  # skipped by design (one that runs on pull requests only, say) goes in MAY_SKIP
+  # by its job id, and only those may end skipped.
   all-checks-passed:
     name: All checks passed
     if: always()
@@ -64,9 +67,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check all jobs succeeded
+        env:
+          NEEDS: ${% raw %}{{ toJSON(needs) }}{% endraw %}
+          MAY_SKIP: '[]'
         run: |
-          if [[ "${% raw %}{{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}{% endraw %}" == "true" ]]; then
-            echo "One or more required checks failed."
+          NOT_PASSED=$(jq -r --argjson skip "$MAY_SKIP" '
+            to_entries[]
+            | select((.value.result == "success" or (.value.result == "skipped" and (.key | IN($skip[])))) | not)
+            | "\(.key): \(.value.result)"' <<< "$NEEDS")
+          if [ -n "$NOT_PASSED" ]; then
+            echo "Not passed:"
+            echo "$NOT_PASSED"
             exit 1
           fi
           echo "All checks passed."