feat: one required status check that fails closed

.github/workflows/ci.yml

@@ -1,9 +1,13 @@
 name: ci
 
 on:
+  # Restricted to main, as every other repo in the org is. With '**' a feature
+  # branch push and its pull request both run this workflow, so two check runs
+  # of the same name report to one commit — and the merge gate is skipped on the
+  # push one, which GitHub scores as Success. A required check whose value
+  # depends on which run reported last is not a gate.
   push:
-    branches:
-      - '**'
+    branches: [main]
   pull_request:
 
 permissions:
@@ -72,3 +76,26 @@ jobs:
           # v2 binary requires action v7. v2.12.x is built with Go 1.26,
           # so it type-checks this module's go 1.26 dependencies cleanly.
           version: v2.12.2
+
+  merge-gate:
+    name: merge gate
+    runs-on: ubuntu-latest
+    needs:
+      [
+        build-and-test,
+        lint,
+      ]
+    # always() is load-bearing: without it a failed dependency SKIPS this job,
+    # and GitHub counts a skipped check as passing for branch protection, so the
+    # gate would report green exactly when something broke.
+    #
+    # Restricted to pull_request because the gate treats a skipped dependency as
+    # a failure, and a job carrying `if: github.event_name == 'pull_request'` is
+    # legitimately skipped on a push to main. The gate exists to gate merges, and
+    # merges come from pull requests; on push it is skipped and gates nothing.
+    if: always() && github.event_name == 'pull_request'
+    steps:
+      - uses: nanohype/.github/actions/merge-gate@6ec6c5b3e6c4a8b15e12da4afd7ac4870a630092 # main
+        with:
+          needs: ${{ toJSON(needs) }}
+          gate-job-id: merge-gate

.github/workflows/security.yml

@@ -1,9 +1,13 @@
 name: security
 
 on:
+  # Restricted to main, as every other repo in the org is. With '**' a feature
+  # branch push and its pull request both run this workflow, so two check runs
+  # of the same name report to one commit — and the merge gate is skipped on the
+  # push one, which GitHub scores as Success. A required check whose value
+  # depends on which run reported last is not a gate.
   push:
-    branches:
-      - '**'
+    branches: [main]
   pull_request:
   schedule:
     # Weekly Tuesday 06:00 UTC — catches newly published CVEs even when no PRs land.
@@ -71,3 +75,26 @@ jobs:
         with:
           sarif_file: gosec.sarif
           category: gosec
+
+  merge-gate-security:
+    name: merge gate (security)
+    runs-on: ubuntu-latest
+    needs:
+      [
+        govulncheck,
+        gosec,
+      ]
+    # always() is load-bearing: without it a failed dependency SKIPS this job,
+    # and GitHub counts a skipped check as passing for branch protection, so the
+    # gate would report green exactly when something broke.
+    #
+    # Restricted to pull_request because the gate treats a skipped dependency as
+    # a failure, and a job carrying `if: github.event_name == 'pull_request'` is
+    # legitimately skipped on a push to main. The gate exists to gate merges, and
+    # merges come from pull requests; on push it is skipped and gates nothing.
+    if: always() && github.event_name == 'pull_request'
+    steps:
+      - uses: nanohype/.github/actions/merge-gate@6ec6c5b3e6c4a8b15e12da4afd7ac4870a630092 # main
+        with:
+          needs: ${{ toJSON(needs) }}
+          gate-job-id: merge-gate-security