From 91bc7766241ccf9ba9611ec065774b69db9d61ab Mon Sep 17 00:00:00 2001
From: paulohenriquevn <paulohenriquevn@gmail.com>
Date: Thu, 27 Aug 2026 09:16:24 -0300
Subject: [PATCH] feat(dep-check): a stable check name for the per-package
 floor runs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`floor-per-package` names itself after its matrix entry, which is what makes
a failure legible — you see WHICH floor broke without opening anything. Two
costs come with that: the name changes with the repository's declared
ranges, so it can never be a required check, and an empty matrix renders the
uninterpolated `${{ matrix.run.dep }}` in the UI.

This job has one name, always reports, and fails if any entry failed.

The case it exists to catch is the one that reads as a pass: a matrix that
was SKIPPED while the plan found floors to exercise. `skipped` is a gap, not
a success, and a required check that never reports is indistinguishable from
one that passed — which is why the `if` is `always()`.

Six cases checked against the branching before committing: count zero with
a skipped matrix passes; success passes; failure, skipped-with-work,
cancelled, and a failed plan each fail.
---
 .github/workflows/dep-check.yml | 43 +++++++++++++++++++++++++++++++++
 CHANGELOG.md                    | 11 +++++++++
 2 files changed, 54 insertions(+)

diff --git a/.github/workflows/dep-check.yml b/.github/workflows/dep-check.yml
index b6cc0ac..3610f0a 100644
--- a/.github/workflows/dep-check.yml
+++ b/.github/workflows/dep-check.yml
@@ -458,3 +458,46 @@ jobs:
             echo "| what the shared pin installs | \`${SHARED}\` |"
             echo "| packages run | ${PACKAGES} |"
           } >> "$GITHUB_STEP_SUMMARY"
+
+  # A stable check name for a job whose real names cannot be stable.
+  #
+  # `floor-per-package` names itself after its matrix entry, which is what makes a failure legible
+  # — you see WHICH floor broke without opening anything. The cost is that the name changes with
+  # the repository's declared ranges, so it can never be a required check, and when the matrix is
+  # empty GitHub renders the uninterpolated expression in the UI.
+  #
+  # This job has one name, always reports, and fails if any matrix entry failed. It is the one to
+  # mark required in branch protection.
+  floor-per-package-result:
+    name: floors the shared pin cannot reach — result
+    needs: [floor-plan, floor-per-package]
+    # `always()` so a skipped matrix still reports. A required check that does not report is
+    # indistinguishable from one that passed, and blocks the pull request forever.
+    if: always() && inputs.run-floor-check
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Report what the extra runs found
+        env:
+          PLAN: ${{ needs.floor-plan.result }}
+          RUNS: ${{ needs.floor-per-package.result }}
+          COUNT: ${{ needs.floor-plan.outputs.count }}
+        run: |
+          set -euo pipefail
+          echo "plan=$PLAN runs=$RUNS count=${COUNT:-0}"
+          if [ "$PLAN" != "success" ]; then
+            echo "::error::could not work out which floors need their own run"
+            exit 1
+          fi
+          if [ "${COUNT:-0}" = "0" ]; then
+            echo "every declared floor is reachable by the shared pin — no extra runs needed"
+            echo "No declared floor is missed by the shared pin, so no extra runs were needed." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          # `skipped` here means the matrix job never ran despite a non-zero count, which is a
+          # gap, not a pass. Only `success` is a pass.
+          if [ "$RUNS" != "success" ]; then
+            echo "::error::$COUNT floor(s) needed their own run and the result was '$RUNS'"
+            exit 1
+          fi
+          echo "$COUNT floor(s) exercised on their own"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e53dec..c994b9d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- `floors the shared pin cannot reach — result`, a check with a stable name that reports whether
+  the per-package floor runs passed. The runs themselves are named after their matrix entry, which
+  is what makes a failure legible without opening anything — and means the name changes with the
+  repository's declared ranges, so it can never be a required check, and renders uninterpolated
+  when the matrix is empty. This one always reports, fails if any entry failed, and treats a
+  skipped matrix with a non-zero count as a gap rather than a pass. It is the one to mark required
+  (#16)
+
+
 ## [dep-check 0.7.0] - 2026-08-27
 
 ### Added