merge-upstream: report the most severe gating workflow state

The gate step exited 0 whatever it found, so a commit whose CI DEB leg went red still produced a green run that merged nothing. A failed leg now fails the job and a cancelled one cancels it, and the step summary tables every gating workflow with a link to its run.

Author: arr2036

.github/workflows/merge-upstream.yml

@@ -33,6 +33,12 @@ name: Merge into upstream
 #  until the last of them lands. Whichever run finds them all green performs
 #  the merge. That avoids a job sitting in a poll loop holding a runner.
 #
+#  This workflow reports the most severe state of the gating workflows, so a
+#  run that merged nothing is never green. Failure outranks cancelled, which
+#  outranks a clean pass. A leg that is still running is not a state yet, so
+#  nothing is reported until every leg has finished, except for a failure,
+#  which nothing can outrank and so reports straight away.
+#
 #  Note that workflow_run only ever uses the copy of this file on the default
 #  branch, and runs in the context of the default branch rather than the branch
 #  being merged - hence head_branch / head_sha / actor throughout.
@@ -72,10 +78,11 @@ jobs:
     timeout-minutes: 15
 
     #  Listing any permission drops the unlisted ones. The pushes below use the
-    #  app token, not GITHUB_TOKEN, so read access is all this needs.
+    #  app token, not GITHUB_TOKEN. actions: write is for this run cancelling
+    #  itself to mirror a cancelled gating workflow, nothing else needs write.
     permissions:
       contents: read
-      actions: read
+      actions: write
 
     env:
       BRANCH: ${{ github.event.workflow_run.head_branch }}
@@ -95,51 +102,109 @@ jobs:
           set -euo pipefail
 
           ready=yes
+          failed=""
+          cancelled=""
+          pending=no
+
+          {
+            echo "### Gating workflows for \`${HEAD_SHA}\`"
+            echo
+            echo "| Workflow | Status | Conclusion |"
+            echo "| --- | --- | --- |"
+          } >> "$GITHUB_STEP_SUMMARY"
 
           for wf in ${REQUIRED_WORKFLOWS}; do
             #  Match the commit and the push event, so a nightly schedule run of
             #  the same workflow is never mistaken for this one.
             info=$(gh api \
               "repos/${GITHUB_REPOSITORY}/actions/workflows/${wf}/runs?head_sha=${HEAD_SHA}&event=push&per_page=1" \
-              --jq '.workflow_runs[0] // empty | "\(.status) \(.conclusion // "none")"') || info=""
+              --jq '.workflow_runs[0] // empty | "\(.status) \(.conclusion // "none") \(.html_url)"') || info=""
 
             if [ -z "${info}" ]; then
               echo "  ${wf}: no run for this commit"
+              echo "| ${wf} | no run | |" >> "$GITHUB_STEP_SUMMARY"
               ready=no
+              pending=yes
               continue
             fi
 
-            status="${info%% *}"
-            conclusion="${info##* }"
+            read -r status conclusion url <<< "${info}"
 
             if [ "${status}" != "completed" ]; then
               echo "  ${wf}: ${status}"
+              echo "| [${wf}](${url}) | ${status} | |" >> "$GITHUB_STEP_SUMMARY"
               ready=no
+              pending=yes
               continue
             fi
 
-            #  A cancelled leg is not a pass. Concurrency cancels the older run
-            #  when a new commit lands, and that result says nothing about this
-            #  commit.
+            echo "  ${wf}: ${conclusion}"
+            echo "| [${wf}](${url}) | ${status} | ${conclusion} |" >> "$GITHUB_STEP_SUMMARY"
+
             case "${conclusion}" in
               success|skipped|neutral)
-                echo "  ${wf}: ${conclusion}"
                 ;;
 
+              #  Concurrency cancels the older run when a newer commit lands,
+              #  so a cancelled leg is not a pass and not a failure either.
+              cancelled)
+                ready=no
+                cancelled="${cancelled} ${wf}"
+                ;;
+
+              #  Anything outside the pass set fails, so a conclusion this
+              #  workflow has not seen before gets reported rather than
+              #  silently ignored.
               *)
-                echo "  ${wf}: ${conclusion}"
                 ready=no
+                failed="${failed} ${wf}"
                 ;;
             esac
           done
 
-          #  Exiting 0 either way: a leg that is still running or has failed is
-          #  not this workflow's problem to report, and failing here would put a
-          #  red run in the Actions tab for every commit that is merely still
-          #  building.
           echo "ready=${ready}" >> "$GITHUB_OUTPUT"
-          if [ "${ready}" != "yes" ]; then
+
+          #  Nothing outranks a failure, so it reports without waiting for the
+          #  legs that are still running.
+          if [ -n "${failed}" ]; then
+            {
+              echo
+              echo "### ${BRANCH} was not merged into master"
+              echo
+              echo "Gating workflows that did not pass:${failed}"
+            } >> "$GITHUB_STEP_SUMMARY"
+
+            echo "::error::${BRANCH} was not merged into master, gating workflows that did not pass:${failed}"
+            exit 1
+          fi
+
+          #  A leg that is still running has no state to report yet, and it can
+          #  still fail, which would outrank the cancelled below.
+          if [ "${pending}" = "yes" ]; then
             echo "Not merging ${BRANCH} yet"
+            exit 0
+          fi
+
+          if [ -n "${cancelled}" ]; then
+            {
+              echo
+              echo "### ${BRANCH} was not merged into master"
+              echo
+              echo "Gating workflows that were cancelled:${cancelled}"
+            } >> "$GITHUB_STEP_SUMMARY"
+
+            echo "::warning::${BRANCH} was not merged into master, gating workflows that were cancelled:${cancelled}"
+
+            #  An exit code only ever picks success or failure, so the run
+            #  cancels itself to mirror the cancelled leg. Parking on a fifo
+            #  with no writer afterwards blocks in the kernel until the runner
+            #  kills the job, so the script never reaches an exit code that
+            #  would overwrite the cancellation. timeout-minutes on the job
+            #  bounds the wait if the cancellation never arrives.
+            gh run cancel "${GITHUB_RUN_ID}"
+
+            mkfifo "${RUNNER_TEMP}/await-cancel"
+            cat "${RUNNER_TEMP}/await-cancel"
           fi
 
       - uses: actions/checkout@v6