2026-06-13 10:01:01 -04:00
1 changed files with 8 additions and 1 deletions
@@ -420,7 +420,7 @@ jobs:

  gate:
    runs-on: ubuntu-latest
-    needs: [fast-checks, changes, api, harness]
+    needs: [fast-checks, changes, api, harness, security]
    if: always()
    steps:
      - name: Check all required jobs passed or were skipped
@@ -430,6 +430,13 @@ jobs:
            echo "fast-checks: ${{ needs.fast-checks.result }}"
            exit 1
          fi
+          # security always runs (gitleaks fires on every PR, D-12) — must be success.
+          # NOT folded into the success-or-skipped loop below — security can never be skipped.
+          # NOTE: individual needs.X.result check (not wildcard) due to Gitea #31007.
+          if [ "${{ needs.security.result }}" != "success" ]; then
+            echo "security: ${{ needs.security.result }}"
+            exit 1
+          fi
          # api and harness are conditionally skipped — success OR skipped are both acceptable
          # NOTE: uses individual needs.X.result checks (not the wildcard aggregate) due to
          # Gitea 1.26.2 bug #31007 where the wildcard expression returns false even when jobs succeed.