Parallelize background CI tasks with wait steps

.github/workflows/ci.yml

@@ -484,19 +484,23 @@ jobs:
         timeout-minutes: 3
         with:
           persist-credentials: false
-      - name: Decide whether the needed jobs succeeded or failed
-        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
-        with:
-          jobs: ${{ toJSON(needs) }}
-      - run: pip install -c ci-constraints-requirements.txt coverage[toml]
-        if: ${{ always() }}
+      # Runs in the background so it overlaps the artifact download
+      # below; the wait step is where a failure here surfaces. A `wait:`
+      # step cannot carry a condition, so it has to sit in a prefix of
+      # steps that nothing failing can skip - which is why the alls-green
+      # check moved to the end of the job.
+      - name: Install coverage
+        id: coverage
+        run: pip install -c ci-constraints-requirements.txt coverage[toml]
+        background: true
       - name: Download coverage data
-        if: ${{ always() }}
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: coverage-data-*
           merge-multiple: true
           path: coverage-data/
+      - name: Wait for coverage
+        wait: [coverage]
       - name: Combine coverage and fail if it's <100%.
         if: ${{ always() }}
         id: combinecoverage
@@ -519,3 +523,10 @@ jobs:
           path: htmlcov
           if-no-files-found: ignore
         if: ${{ failure() && steps.combinecoverage.outcome == 'failure' }}
+      # always(), so that a failure in the coverage steps above doesn't
+      # skip this and lose the report of which needed job failed.
+      - name: Decide whether the needed jobs succeeded or failed
+        if: ${{ always() }}
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
+        with:
+          jobs: ${{ toJSON(needs) }}