How do I set a github branch protection rule based on the success or failure of an entire github actions workflow?

Question

I'm trying to set a github branch protection rule based on the success or failure of a github actions workflow.

You can see the workflow here:

https://github.com/apostrophecms/apostrophe/blob/main/.github/workflows/main.yml

The workflow passes, and I even have a working badge for it, but I am unable to set a branch protection rule requiring that it pass as a status check.

I can set a branch protection rule based on any one of the individual builds in the matrix, but I don't want to set all of them individually and keep track of that as my matrix rule changes.

As you can see from the screenshots, I am unable to pick "build", the name of the job (although I can pick any of the sub-builds), and I am also unable to pick "tests", the name of the workflow as a whole (it does not change if I use an uppercase t).

What am I missing? Thanks for your help!

Screenshot one: I can pick a sub-build but not the entire build job.

Screenshot two: I can't pick the name of the overall "Tests" workflow at all.

Answer 1

In this case, you have a single job with a matrix. That means you'll end with 9 possibilities (3 node options × 3 MongoDB options). Each of those is considered a separate status check and can be enabled or disabled as mandatory individually. This is so that you can add new options without making them mandatory up front.

If you want every one of those jobs to pass, then you need to choose every one of the 9 jobs and mark them as required.

Answer 2

There's a trick to add one step to the workflow to collect all jobs from the matrix to one check:

  tests:
    runs-on: ubuntu-latest
    needs: build
    if: always()
    steps:
      - name: All tests ok
        if: ${{ !(contains(needs.*.result, 'failure')) }}
        run: exit 0
      - name: Some tests failed
        if: ${{ contains(needs.*.result, 'failure') }}
        run: exit 1

if: always() is obligatory to collect failed tasks, otherwise PR will never get a proper status check. Also, this is an additional step for you to pay (if you use paid plans).