chore(governance): required-job audit — repos missing `required` status-check gate

[github-actions]

The weekly required-job audit detected repos without a CI job emitting the required status-check context.

These repos are governed by org ruleset default-branch-baseline (id 15191038) which requires that context. Until a required job is added, PRs will hang in "Expected — Waiting for status to be reported" and be blocked from merge.

Repos missing the required job

• crates (branch=master)

Repos exempt via ruleset exclude list (informational)

(none)

Repos unreachable by the audit runner (likely private; set SYNC_TOKEN for full coverage)

(none)

Fix

For each listed repo, append a terminal required job to the repo's main CI workflow:

  required:
    name: required
    needs: [<all-real-job-names>]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - env:
          RESULTS: \{}
        run: |
          set -eu
          echo "$RESULTS" | jq -r 'to_entries[] | "\(.key)=\(.value.result)"'
          if echo "$RESULTS" | jq -e 'to_entries[] | select(.value.result != "success" and .value.result != "skipped")' >/dev/null; then
            exit 1
          fi

Reference implementation: resq-software/npm#46

Alternative

If exclusion is intentional, add the repo to the ruleset's conditions.repository_name.exclude list:

gh api /orgs/resq-software/rulesets/15191038 \
  | jq '.conditions.repository_name.exclude += ["<repo-name>"]' \
  | gh api --method PUT /orgs/resq-software/rulesets/15191038 --input -

---

Audit run: https://github.com/resq-software/.github/actions/runs/29237419866