ci: fail gha-done when a required job fails or is cancelled

[claude]

Requested by Samuel Attard · Slack thread

The gha-done job ("GitHub Actions Completed") used if: always() && !contains(needs.*.result, 'failure'), so when test or build failed the gate job was skipped rather than failed, and a skipped required check counts as passing; cancelled runs were not caught either. This changes gha-done to always run and adds a step that fails if test or build failed or were cancelled, matching the required-ci logic in electron/forge. The job id, name and needs are unchanged, so the existing ruleset check name keeps matching.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rx13DJRnFBvVNh1ioMMXsQ

---

Generated by Claude Code

[coveralls]

coverage: 87.341%. remained the same — ci/required-ci-gate into main

[claude]

Three test jobs failed on f5a02da, and none of the failures come from this PR:

• test / Test (ubuntu-24.04-arm, armv7l)
• test / Test (ubuntu-latest, x64)
• test / Test (windows-latest, x64)

All three jobs fail the same 3 tests in tests/main/devtools.spec.ts, and the other 900 tests pass:

TypeError: vi.mocked(...).mockReturnValue is not a function
 ❯ tests/main/devtools.spec.ts:32:26
     vi.mocked(isDevMode).mockReturnValue(false);

Why it isn't this PR: the only file changed here is .github/workflows/ci.yml, in the gha-done job. No source or test files are touched. The same 3 tests already fail on main at this PR's base commit a63225b (#2017, "upgrade vitest to v5"), in test / Test (macos-latest, arm64). In that run the two Ubuntu test jobs passed, so the failure shows up on some platforms in some runs. It looks like the vi.mock('../../src/main/utils/devmode') automock in this spec sometimes doesn't apply under vitest v5. That main run's gate job was also skipped, not failed, which is the problem this PR fixes.

Fix: I didn't find an open PR or issue that fixes this.

---

Generated by Claude Code

[claude]

Looks good, straightforward CI config fix. Reviewed the changed if condition on the "GitHub Actions Completed" job and the new "Fail if any required job failed or was cancelled" step — the job now always runs but explicitly exits 1 (via env-passed needs.test.result/needs.build.result, avoiding direct expression interpolation into the shell script) when a dependency failed or was cancelled, and the job id/name/needs are unchanged so it should keep matching existing branch-protection rules.

Extended reasoning...

The diff touches only .github/workflows/ci.yml, changing the completion gate job's if condition and adding one step that fails the job when the test or build job failed/was cancelled. No secrets or untrusted input are involved; job results are passed via env: rather than interpolated directly into the run script, avoiding shell-injection concerns. The repo-wide CODEOWNERS (@ electron/wg-ecosystem, @ codebytere) covers this path but the change is small, mechanical, and matches its stated intent exactly, with no bug-hunter findings and no unresolved reviewer objections in the timeline.