From 18c137cd1f6cf374ecafec8714a0230186fec2af Mon Sep 17 00:00:00 2001
From: Lars Francke <git@lars-francke.de>
Date: Wed, 5 Aug 2026 00:48:54 +0200
Subject: [PATCH 1/2] test: Verify "Finished Build and Publish" gate catches
 failures

DO NOT MERGE. Test branch for stackabletech/operator-templating#614.

- Apply the fixed `finished` gate (if: always() + explicit result check +
  all leaf jobs as direct needs).
- Temporarily force publish-index-manifest to fail, reproducing the bug
  where the gate was skipped (and thus treated as passing by branch
  protection). With the fix, the gate must now report failure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build.yaml | 40 ++++++++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 93259455..351d5a2b 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -214,6 +214,14 @@ jobs:
         with:
           persist-credentials: false
 
+      # TEMPORARY - DO NOT MERGE
+      # Force this job to fail to reproduce the mergeable-broken-build bug and
+      # verify the fixed `finished` gate now reports failure instead of skipped.
+      - name: TEMP force failure to exercise the finished gate
+        run: |
+          echo "Intentionally failing publish-index-manifest."
+          exit 1
+
       - name: Publish and Sign Image Index to oci.stackable.tech
         id: publish-oci
         uses: stackabletech/actions/publish-image-index-manifest@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3
@@ -372,13 +380,41 @@ jobs:
     # WARNING: Do not change the name unless you will also be changing the
     # Required Checks (in branch protections) in GitHub settings.
     name: Finished Build and Publish
+    # Run even when a dependency failed, was skipped or cancelled, so that this
+    # gate reflects the real outcome. Without `always()` a failed dependency
+    # would *skip* this job, and GitHub treats a skipped required check as
+    # passing - making a broken build mergeable.
+    if: always()
+    # List every leaf job directly. A transitive failure (e.g. a failed
+    # publish-index-manifest that skips openshift-preflight-check) does not
+    # surface as `failure` in `needs.*.result` unless the failing job is a
+    # direct dependency.
     needs:
+      - detect-changes
       - cargo-udeps
-      - openshift-preflight-check
+      - build-container-image
+      - publish-index-manifest
+      - provenance-oci
+      - provenance-quay
       - publish-helm-chart
+      - openshift-preflight-check
     runs-on: ubuntu-latest
     steps:
-      - run: echo "We are done here"
+      # Skipped dependencies are fine (jobs skip legitimately on merge_group
+      # events, forks, or when detect-changes finds no relevant changes). Only
+      # a failure or cancellation must fail this gate.
+      - name: Fail on any failed or cancelled dependency
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          echo "Dependency results: $RESULTS"
+          for result in $RESULTS; do
+            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then
+              echo "::error::A required job did not succeed (result: $result)"
+              exit 1
+            fi
+          done
+          echo "We are done here"
 
   notify:
     name: Failure Notification

From c0a7f291d75d6f4f83e6ee2ae6d8248904f7d833 Mon Sep 17 00:00:00 2001
From: Lars Francke <git@lars-francke.de>
Date: Thu, 6 Aug 2026 00:43:00 +0200
Subject: [PATCH 2/2] test: Remove forced failure to confirm gate stays green

Drops the throwaway `exit 1` from publish-index-manifest. A clean run now
verifies the fixed `Finished Build and Publish` gate does not produce false
positives.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 351d5a2b..ed030b1a 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -214,14 +214,6 @@ jobs:
         with:
           persist-credentials: false
 
-      # TEMPORARY - DO NOT MERGE
-      # Force this job to fail to reproduce the mergeable-broken-build bug and
-      # verify the fixed `finished` gate now reports failure instead of skipped.
-      - name: TEMP force failure to exercise the finished gate
-        run: |
-          echo "Intentionally failing publish-index-manifest."
-          exit 1
-
       - name: Publish and Sign Image Index to oci.stackable.tech
         id: publish-oci
         uses: stackabletech/actions/publish-image-index-manifest@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3