[ci] check all-jobs-succeed depends on all jobs (#720)

* [ci] check all-jobs-succeed depends on all jobs

Closes #444

* [ci] Print message when check-job-dependencies fails

This also changes the logic somewhat (hopefully in a way that improves
readability).  There was a bit of a self-check in place before that has been
removed because it made the code hard to explain (too many double negatives).

* [ci] Improve message for check-job-dependencies

* [ci] Use less obscure line filter

* [ci] Update comment to reflect change in code

* [ci] Be more specific on ignoring exit status

.github/workflows/ci.yml

@@ -461,6 +461,40 @@ jobs:
           cargo install --locked kani-verifier       &> /dev/null || true
           cargo kani setup                           &> /dev/null || true
 
+  check-job-dependencies:
+    runs-on: ubuntu-latest
+    name: Check all-jobs-succeeded depends on all jobs
+    steps:
+      - name: Install yq (for YAML parsing)
+        run: go install github.com/mikefarah/yq/v4@latest
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: Run dependency check
+        run: |
+          set -eo pipefail
+          jobs=$(for i in $(find .github -iname '*.yaml' -or -iname '*.yml')
+            do
+              # Select jobs that are triggered by pull request.
+              if yq -e '.on | has("pull_request")' "$i" 2>/dev/null >/dev/null
+              then
+                # This gets the list of jobs that all-jobs-succeed does not depend on.
+                comm -23 \
+                  <(yq -r '.jobs | keys | .[]' "$i" | sort | uniq) \
+                  <(yq -r '.jobs.all-jobs-succeed.needs[]' "$i" | sort | uniq)
+              fi
+
+            # The grep call here excludes all-jobs-succeed from the list of jobs that
+            # all-jobs-succeed does not depend on.  If all-jobs-succeed does
+            # not depend on itself, we do not care about it.
+            done | sort | uniq | (grep -v '^all-jobs-succeed$' || true)
+          )
+
+          if [ -n "$jobs" ]
+          then
+            missing_jobs="$(echo "$jobs" | tr ' ' '\n')"
+            echo "all-jobs-succeed missing dependencies on some jobs: $missing_jobs" | tee -a $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
   # Used to signal to branch protections that all other jobs have succeeded.
   all-jobs-succeed:
       name: All checks succeeded
@@ -471,7 +505,7 @@ jobs:
       # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
       if: failure()
       runs-on: ubuntu-latest
-      needs: [build_test, kani, check_fmt, check_readme, check_msrv, check_versions, generate_cache]
+      needs: [build_test, kani, check_fmt, check_readme, check_msrv, check_versions, generate_cache, check-job-dependencies]
       steps:
         - name: Mark the job as failed
           run: exit 1