From f0f7d8a9f48c3241ed14a901e2956eb4db1f97d2 Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Sat, 13 Jun 2026 08:23:20 -0400
Subject: [PATCH] ci(16-05): wire security job into gate aggregator
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- gate needs: expanded to include security
- individual needs.security.result check added (requires success, not success-or-skipped)
- security not folded into api/harness for loop — gitleaks always runs so it cannot be skipped
- follows Gitea #31007 individual needs.X.result pattern
---
 .gitea/workflows/ci.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 17c0d40..c41a754 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -420,7 +420,7 @@ jobs:
 
   gate:
     runs-on: ubuntu-latest
-    needs: [fast-checks, changes, api, harness]
+    needs: [fast-checks, changes, api, harness, security]
     if: always()
     steps:
       - name: Check all required jobs passed or were skipped
@@ -430,6 +430,13 @@ jobs:
             echo "fast-checks: ${{ needs.fast-checks.result }}"
             exit 1
           fi
+          # security always runs (gitleaks fires on every PR, D-12) — must be success.
+          # NOT folded into the success-or-skipped loop below — security can never be skipped.
+          # NOTE: individual needs.X.result check (not wildcard) due to Gitea #31007.
+          if [ "${{ needs.security.result }}" != "success" ]; then
+            echo "security: ${{ needs.security.result }}"
+            exit 1
+          fi
           # api and harness are conditionally skipped — success OR skipped are both acceptable
           # NOTE: uses individual needs.X.result checks (not the wildcard aggregate) due to
           # Gitea 1.26.2 bug #31007 where the wildcard expression returns false even when jobs succeed.