ci: give each matrix leg its own check name

.github/workflows/ci.yml

@@ -19,7 +19,13 @@ concurrency:
 jobs:
   # ── Test Matrix ───────────────────────────────────────────────────────────
   test:
-    name: Test (Python ${{ matrix.python-version }})
+    # Both matrix dimensions belong in the name. With only the Python
+    # version here, the ubuntu, macOS and Windows legs all reported under
+    # one check name -- three check runs called "Test (Python 3.10)" --
+    # so a Windows-only failure was indistinguishable from the other two
+    # until you opened it, and no branch protection rule could name one
+    # leg without naming all three.
+    name: Test (Python ${{ matrix.python-version }}, ${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -94,7 +100,10 @@ jobs:
         uses: codecov/codecov-action@v4
         with:
           files: coverage.xml
-          flags: ebuild-py${{ matrix.python-version }}
+          # Names both dimensions, for the same reason the job above does:
+          # nine legs reporting under three flags loses the OS split in
+          # coverage exactly as it was lost in the checks list.
+          flags: ebuild-py${{ matrix.python-version }}-${{ matrix.os }}
 
   # ── Build Python Package ──────────────────────────────────────────────────
   build:
@@ -137,3 +146,43 @@ jobs:
         with:
           files: dist/*
           generate_release_notes: true
+
+  # ── Required check ────────────────────────────────────────────────────────
+  # One job that succeeds only if every other job in this workflow did, so
+  # branch protection has a single stable name to require. #87 asks for a
+  # required check on master; this is the name to point it at.
+  #
+  # Requiring the jobs themselves does not work here. `test` is a 3x3 matrix,
+  # so its checks arrive as nine generated names that change whenever the
+  # matrix does, and a required name that no longer appears blocks every PR
+  # until someone edits the branch protection. `release` is skipped on every
+  # pull request, and a required check that is skipped never reports.
+  #
+  # `if: always()` matters: without it the gate is skipped whenever an earlier
+  # job fails, and a skipped required check leaves the PR waiting for a status
+  # that will never arrive -- the failure would present as a hang, not a red X.
+  #
+  # A non-success result of any kind fails the gate, `skipped` included. A job
+  # that did not run did not verify anything, so treating it as a pass is the
+  # same fail-open shape this repository has been removing elsewhere.
+  ci-gate:
+    name: CI Gate
+    runs-on: ubuntu-22.04
+    needs: [test, build]
+    if: always()
+    steps:
+      - name: Every job in this workflow must have succeeded
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          printf '%s\n' "$RESULTS"
+          bad=$(printf '%s' "$RESULTS" | jq -r '
+            to_entries[]
+            | select(.value.result != "success")
+            | "  \(.key): \(.value.result)"')
+          if [ -n "$bad" ]; then
+            echo "::error::CI Gate failed. These jobs did not succeed:"
+            printf '%s\n' "$bad"
+            exit 1
+          fi
+          echo "All jobs succeeded."

.github/workflows/nightly.yml

@@ -14,7 +14,11 @@ concurrency:
 
 jobs:
   full-test-suite:
-    name: Full Test Suite
+    # Both matrix legs belong in the name: with a static name the three
+    # Python legs all reported as one check run called "Full Test Suite".
+    # Last remaining instance of the defect ci.yml's rename fixed; renaming
+    # is cheap exactly while nothing refers to the old name.
+    name: Full Test Suite (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
     strategy:
       matrix: