From 736a797016764a5e7a64c1d0a73030892711b878 Mon Sep 17 00:00:00 2001
From: David Pine <david.pine@microsoft.com>
Date: Thu, 26 Mar 2026 17:46:10 -0500
Subject: [PATCH] Add CI gate check for conditional jobs

Add an always-run ci-gate job that verifies conditional jobs either ran successfully or were intentionally skipped. This gives branch protection a single stable check to require while preserving the existing conditional workflow behavior.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/ci.yml | 57 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bb9be33dc..eec54868a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,3 +64,60 @@ jobs:
     uses: ./.github/workflows/integration.yml
     with:
       node_version:  '24.x'
+
+  ci-gate:
+    needs: [changes, frontend-build, apphost-build, integration-test]
+    if: ${{ always() && !cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify CI results
+        shell: bash
+        env:
+          CHANGES_RESULT: ${{ needs.changes.result }}
+          FRONTEND_CHANGED: ${{ needs.changes.outputs.frontend }}
+          APPHOST_CHANGED: ${{ needs.changes.outputs.apphost }}
+          FRONTEND_RESULT: ${{ needs['frontend-build'].result }}
+          APPHOST_RESULT: ${{ needs['apphost-build'].result }}
+          INTEGRATION_RESULT: ${{ needs['integration-test'].result }}
+        run: |
+          echo "changes result: $CHANGES_RESULT"
+          echo "frontend changed: $FRONTEND_CHANGED"
+          echo "frontend-build result: $FRONTEND_RESULT"
+          echo "apphost changed: $APPHOST_CHANGED"
+          echo "apphost-build result: $APPHOST_RESULT"
+          echo "integration-test result: $INTEGRATION_RESULT"
+
+          if [[ "$CHANGES_RESULT" != "success" ]]; then
+            echo "The changes job must succeed."
+            exit 1
+          fi
+
+          if [[ "$FRONTEND_CHANGED" == "true" ]]; then
+            if [[ "$FRONTEND_RESULT" != "success" ]]; then
+              echo "frontend-build should have run and succeeded."
+              exit 1
+            fi
+          elif [[ "$FRONTEND_RESULT" != "skipped" ]]; then
+            echo "frontend-build should have been skipped."
+            exit 1
+          fi
+
+          if [[ "$APPHOST_CHANGED" == "true" ]]; then
+            if [[ "$APPHOST_RESULT" != "success" ]]; then
+              echo "apphost-build should have run and succeeded."
+              exit 1
+            fi
+          elif [[ "$APPHOST_RESULT" != "skipped" ]]; then
+            echo "apphost-build should have been skipped."
+            exit 1
+          fi
+
+          if [[ "$FRONTEND_CHANGED" == "true" || "$APPHOST_CHANGED" == "true" ]]; then
+            if [[ "$INTEGRATION_RESULT" != "success" ]]; then
+              echo "integration-test should have run and succeeded."
+              exit 1
+            fi
+          elif [[ "$INTEGRATION_RESULT" != "skipped" ]]; then
+            echo "integration-test should have been skipped."
+            exit 1
+          fi