From 24365dfbf446917f7271da1094ad891b1bebd372 Mon Sep 17 00:00:00 2001
From: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
Date: Wed, 9 Sep 2026 17:57:01 +0700
Subject: [PATCH] ci: measure the semver gate against 2.2.0, and give `main`
 one check to require
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to the 2.2.0 publish, per docs/RELEASING.md "After the tag".

- The `semver` job's `--baseline-version` moves 2.1.0 -> 2.2.0, now that
  2.2.0 is on the index. Until this lands every PR is compared against a
  release nobody installs any more.

- `required-green` aggregates every job in ci.yml behind one check name, so
  `main`'s ruleset can require *that* instead of each job by name. Adding a
  job to this workflow then protects `main` automatically, rather than
  silently not being required until somebody remembers to edit the ruleset
  — which is the exact failure this repository has been carrying: `main` had
  no protection at all, so every gate 2.2.0 added reported without blocking.

  `if: always()` plus an explicit scan of `needs.*.result`, because `needs`
  alone marks the job *skipped* when a dependency fails, and a skipped
  required check does not block a merge. Copied from reconverge, where the
  same job guards the same way.

  The three checks outside this workflow -- `gate` (prune.yml), `check`
  (commit-policy.yml) and `termlens` (stress.yml) -- are required by name in
  the ruleset; an aggregator cannot span workflows.

- RELEASING.md now says where the baseline literal actually lives. It is a
  `--baseline-version` argument in a shell step, not a YAML input, and
  looking for the latter finds only the comment explaining it.

Signed-off-by: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
---
 .github/workflows/ci.yml | 32 +++++++++++++++++++++++++++++++-
 docs/RELEASING.md        |  6 ++++--
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ebdac9b..c896084 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -90,7 +90,7 @@ jobs:
         run: |
           echo "release-type: $RELEASE_TYPE"
           cargo semver-checks --workspace \
-            --baseline-version 2.1.0 \
+            --baseline-version 2.2.0 \
             --release-type "$RELEASE_TYPE"
 
   # MSRV applies to the crates that do not need the pinned nightly
@@ -106,3 +106,33 @@ jobs:
         with:
           tool: just
       - run: just msrv
+
+  # One green check standing for every job in this workflow.
+  #
+  # `main`'s ruleset requires this rather than each job by name, so adding a
+  # job here protects `main` automatically instead of silently not being
+  # required until somebody remembers to edit the ruleset. That is the
+  # failure mode this exists to prevent: an unrequired gate is a gate that
+  # reports.
+  #
+  # `if: always()` plus an explicit scan, because `needs` alone would mark
+  # this skipped when a dependency fails — and a skipped required check does
+  # not block a merge. The three checks outside this workflow (`gate`,
+  # `check`, `termlens`) are required by name in the ruleset.
+  required-green:
+    name: required-green
+    if: always()
+    needs: [ci, semver, msrv]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify every gate succeeded
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          echo "gate results: $RESULTS"
+          for r in $RESULTS; do
+            if [ "$r" != "success" ]; then
+              echo "a required gate did not succeed" >&2
+              exit 1
+            fi
+          done
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index eefe649..37839b8 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -74,7 +74,9 @@ tag had to be pushed by hand.
   ```sh
   gh workflow run install.yml
   ```
-- **Move the semver baseline, in a PR of its own after the publish.**
+- **Move the semver baseline, in a PR of its own after the publish.** It is
+  the `--baseline-version` literal in `ci.yml`'s `semver` job, not a YAML
+  input — `grep baseline-version .github/workflows/ci.yml` finds it.
   `baseline-version` in `ci.yml`'s `semver` job is a literal. Left at the old
   release it compares every PR against a version nobody can install any more,
   and it would also carry this release's own breaks forward as if they were
@@ -83,7 +85,7 @@ tag had to be pushed by hand.
   bump the literal.
 
   ```sh
-  $EDITOR .github/workflows/ci.yml   # baseline-version: X.Y.Z
+  $EDITOR .github/workflows/ci.yml   # --baseline-version X.Y.Z
   ```
 - **A break needs the `breaking` label on its PR**, which switches the semver
   job from `patch` to `major`. Without it the job fails, which is the point;