From 7f7e991f26d09ca2c18f1e552c762179f236ea71 Mon Sep 17 00:00:00 2001
From: letur <magicletur@protonmail.com>
Date: Mon, 25 May 2026 20:48:46 +0200
Subject: [PATCH] ci: add all-checks aggregator job for branch-protection
 rulesets

Mirrors the pattern from Thurbeen/thurbox. A single `All Checks` job
whose status rolls up `markdown-lint`, `schema-validate`, `link-check`,
and `conventional-commits` means the repository ruleset references one
stable check name; adding or removing individual CI jobs no longer
forces a ruleset edit.

The `if: always()` plus `contains(needs.*.result, 'failure'|'cancelled')`
pattern ensures the aggregator fails fast on any sub-job failure (or
cancellation) and passes only when every dependency succeeded.
---
 .github/workflows/ci.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dec736a..927563e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,3 +89,25 @@ jobs:
         uses: wagoid/commitlint-github-action@v6
         with:
           configFile: .commitlintrc.json
+
+  all-checks:
+    name: All Checks
+    # Aggregator job whose single status is what branch-protection rulesets
+    # reference. Adding/removing individual CI jobs no longer requires
+    # touching the ruleset — just update this job's `needs:`.
+    if: always()
+    needs:
+      - markdown-lint
+      - schema-validate
+      - link-check
+      - conventional-commits
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify all checks passed
+        run: |
+          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]] || \
+             [[ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
+            echo "One or more checks failed or were cancelled"
+            exit 1
+          fi
+          echo "All checks passed"