From bf454a805b1469b68f4a5fae9b883bd4b115b6c0 Mon Sep 17 00:00:00 2001
From: Peter Corke <peter.i.corke@gmail.com>
Date: Thu, 30 Jul 2026 09:57:46 +1000
Subject: [PATCH] ci: add an all-tests-passed aggregator job

Branch protection needs a single, stable required-check name to gate
merges on. Requiring all 12 individual `test (os, python-version)`
matrix legs directly is brittle -- adding/removing a matrix entry
silently changes what's enforced without anyone updating branch
protection settings. This job depends on the whole matrix and fails
loudly (rather than relying on ambiguous "skipped" semantics) if any
leg didn't succeed, giving one check name to require instead.

Not touching branch protection itself here -- that's a repo-settings
change, done separately once this merges and has run at least once.
---
 .github/workflows/ci.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f8da21e7..ac8f5528 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,6 +58,19 @@ jobs:
           MPLBACKEND: Agg
         run: micromamba run -n myenv python -m pytest --timeout=50 --timeout-method=thread
 
+  all-tests-passed:
+    name: All tests passed
+    needs: test
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Check test matrix result
+        run: |
+          if [ "${{ needs.test.result }}" != "success" ]; then
+            echo "test matrix did not succeed: ${{ needs.test.result }}"
+            exit 1
+          fi
+
   codecov:
     needs: test
     if: github.event_name == 'push'