feat: one required status check that fails closed

.github/workflows/ci.yml

@@ -294,3 +294,31 @@ jobs:
         run: node scripts/sync-vendored.mjs --self-test
         env:
           NANOHYPE_DIR: .nanohype
+
+  merge-gate:
+    name: merge gate
+    runs-on: ubuntu-latest
+    needs:
+      [
+        verify,
+        docs,
+        helm,
+        platform-manifests,
+        crd-schema-drift,
+        docker,
+        vendor-drift,
+      ]
+    # always() is load-bearing: without it a failed dependency SKIPS this job,
+    # and GitHub counts a skipped check as passing for branch protection, so the
+    # gate would report green exactly when something broke.
+    #
+    # Restricted to pull_request because the gate treats a skipped dependency as
+    # a failure, and a job carrying `if: github.event_name == 'pull_request'` is
+    # legitimately skipped on a push to main. The gate exists to gate merges, and
+    # merges come from pull requests; on push it is skipped and gates nothing.
+    if: always() && github.event_name == 'pull_request'
+    steps:
+      - uses: nanohype/.github/actions/merge-gate@6ec6c5b3e6c4a8b15e12da4afd7ac4870a630092 # main
+        with:
+          needs: ${{ toJSON(needs) }}
+          gate-job-id: merge-gate

.github/workflows/security.yml

@@ -116,3 +116,27 @@ jobs:
           exit-code: '1'
           skip-dirs: 'node_modules'
           skip-db-update: true
+
+  merge-gate-security:
+    name: merge gate (security)
+    runs-on: ubuntu-latest
+    needs:
+      [
+        gitleaks,
+        trivy-config,
+        trivy-fs,
+      ]
+    # always() is load-bearing: without it a failed dependency SKIPS this job,
+    # and GitHub counts a skipped check as passing for branch protection, so the
+    # gate would report green exactly when something broke.
+    #
+    # Restricted to pull_request because the gate treats a skipped dependency as
+    # a failure, and a job carrying `if: github.event_name == 'pull_request'` is
+    # legitimately skipped on a push to main. The gate exists to gate merges, and
+    # merges come from pull requests; on push it is skipped and gates nothing.
+    if: always() && github.event_name == 'pull_request'
+    steps:
+      - uses: nanohype/.github/actions/merge-gate@6ec6c5b3e6c4a8b15e12da4afd7ac4870a630092 # main
+        with:
+          needs: ${{ toJSON(needs) }}
+          gate-job-id: merge-gate-security