ci: make Verify Examples self-verifying and gate on every check

Three fixes from the third review on #844.

Trigger Verify Examples on its own machinery. The workflow only ran for
examples/**, so a pull request changing example-matrix.json or
select-examples.sh — now the single source of truth for what gets verified —
never ran it. This pull request is the proof: it rewires all three matrices and
its checks are Commit Lint, CodeQL and pr.yaml only, no validate or test-* at
all. The matrix file, the selector directory and this workflow are now triggers,
so it verifies its own changes.

src/, layer/ and Cargo.* are deliberately still not pull request triggers even
though the selector treats them as shared: adding them would run all eighteen
matrix entries on every source pull request. Adapter changes stay verified against
the examples on push to main, and the shared-path rule still applies to a pull
request touching both.

Gate on the whole check rollup, not just this one run. Commit Lint runs on every
pull request with no path filter and does go red on Dependabot PRs (#799), yet the
merge consulted only the Verify Examples run, and any check added later would have
been ignored too. Anything not SUCCESS/SKIPPED/NEUTRAL — including still running,
since a workflow_run job cannot wait — now refuses the merge; Dependabot rebases
these branches often and any later run re-evaluates. Verified against live data:
the query is empty for #842 (all green, CodeQL NEUTRAL) and names the failure on
#844. This workflow's own run is excluded defensively, since an in-progress
self-check would deadlock every merge if workflow_run runs ever joined the rollup.

Add the github-actions ecosystem for the commit prefix, for the same reason
bundler was added: every workflow pins actions, so an advisory would open a PR
with no conventional type and a red Commit Lint. With the limit at 0 it adds no
pull requests. Pre-emptive — there are no open actions alerts today (the 705 open
alerts are npm, pip, go, rubygems, rust and maven).

Author: bnusunny

.github/dependabot.yml

@@ -124,3 +124,23 @@ updates:
         applies-to: security-updates
         patterns:
           - "*"
+
+  # Not an example, and listed for the naming alone. Every workflow here pins actions
+  # (actions/checkout@v4, Swatinem/rust-cache@v2, orhun/git-cliff-action@v4), so an
+  # actions advisory would open a PR titled "bump actions/... from X to Y" — no
+  # conventional type, red Commit Lint, manual amend. With the limit at 0 this adds no
+  # pull requests; it only names the ones an advisory would produce anyway. There are
+  # no open actions alerts today, so this is pre-emptive.
+  - package-ecosystem: github-actions
+    directories:
+      - "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: ci
+    groups:
+      github-actions:
+        applies-to: security-updates
+        patterns:
+          - "*"

.github/workflows/dependabot-automerge.yaml

@@ -103,6 +103,28 @@ jobs:
             exit 0
           fi
 
+          # Verify Examples is not the only check on the pull request. Commit Lint runs
+          # on every pull request with no path filter and does go red on Dependabot
+          # PRs (#799), and any check added later would be ignored here too. Anything
+          # not green — including still running, since this workflow cannot wait — means
+          # leave it alone; Dependabot rebases these branches often, and any later
+          # Verify Examples run re-evaluates the pull request.
+          #
+          # This workflow's own run is excluded defensively. workflow_run runs do not
+          # currently appear in a pull request's check rollup, but if that changed, its
+          # in-progress state would deadlock every merge.
+          not_green=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json statusCheckRollup -q '
+            .statusCheckRollup[]
+            | select((.workflowName // "") != "Dependabot Auto-merge")
+            | select([((.conclusion // .state // "PENDING") | ascii_upcase)]
+                     - ["SUCCESS", "SKIPPED", "NEUTRAL"] | length > 0)
+            | ((.name // .context) + " = " + (.conclusion // .state // "PENDING"))')
+          if [[ -n "$not_green" ]]; then
+            echo "PR #$PR_NUMBER has checks that are not green; refusing to merge:"
+            echo "$not_green" | sed 's/^/  /'
+            exit 0
+          fi
+
           # Covered examples are only actually verified if their jobs ran. Count lines
           # rather than asking jq for a length: --paginate applies -q per page, so a
           # run spanning two pages would yield one count per line ("18\n4"), and

.github/workflows/examples.yaml

@@ -6,11 +6,24 @@ on:
       - main
     paths:
       - "examples/**"
+      # This workflow's own machinery. The matrix file and the selector decide what
+      # gets verified at all, so a pull request that changes only those would
+      # otherwise not run here — and a malformed matrix or a selector regression
+      # would land unverified and surface later on an unrelated examples pull
+      # request. Including them makes the workflow verify its own changes.
+      - ".github/workflows/examples.yaml"
+      - ".github/scripts/**"
+      - ".github/example-matrix.json"
   push:
     branches:
       - main
     paths:
       - "src/**"
+  # Note that src/, layer/ and Cargo.* are deliberately NOT pull request triggers,
+  # even though select-examples.sh treats them as shared: adding them would run all
+  # eighteen matrix entries on every source pull request. Adapter changes are verified
+  # against the examples on push to main (above), and the selector's shared-path rule
+  # still applies to a pull request that touches both source and examples.
   workflow_dispatch:
 
 permissions: