internal/ci: always check that git is clean when we finish

That is, check that git is clean even if a previous step failed.
In https://cuelang.org/cl/1194425 this caused some confusion;
the author forgot to run `go generate ./...`, and since CI runs
that command as a step before `go test ./...` on the main Linux job,
CI seemed to run into a "go test" failure that the author did not.

This human error would have been more obvious if CI had also failed
with "git is not clean" including a diff of the generated code.
By default, a GitHub Actions step only runs if all previous steps
have succeeded, but we can use the "always" condition to also run
even if the job already failed due to a previous step.

Signed-off-by: Daniel Martí <mvdan@mvdan.cc>
Change-Id: Ied1c1eb98d53b23f68650d946cc6341d8c2f3c3d
Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/1196088
TryBot-Result: CUEcueckoo <cueckoo@cuelang.org>
Reviewed-by: Noam Dolovich <noam.tzvi.dolovich@gmail.com>
Reviewed-by: Paul Jolly <paul@myitcv.io>
Unity-Result: CUE porcuepine <cue.porcuepine@gmail.com>

.github/workflows/trybot.yml

@@ -191,5 +191,6 @@ jobs:
         run: |-
           go vet ./...
           go mod tidy
-      - name: Check that git is clean at the end of the job
+      - if: always()
+        name: Check that git is clean at the end of the job
         run: test -z "$(git status --porcelain)" || (git status; git diff; false)

internal/ci/base/github.cue

@@ -280,6 +280,7 @@ isReleaseTag: {
 
 checkGitClean: json.#step & {
 	name: "Check that git is clean at the end of the job"
+	if:   "always()"
 	run:  "test -z \"$(git status --porcelain)\" || (git status; git diff; false)"
 }