ci: add PR Results gate to pr-open.yml

[DerekRoberts]

Adds a single PR Results merge gate to pr-open.yml using bcgov/actions/workflow-results, pinned to the v0.9.0 release commit (79aefe3, the latest release). No other pins changed, no jobs renamed, no title:, no version changes.

Check to require on main: PR Results (from pr-open.yml). Nothing else is needed for this workflow.

Structure

• PR Results needs every job in pr-open.yml: Actionlint, Path filters, Test Deployer, Test Crunchy, Route TLS path filter, Test Route TLS, Test Route TLS logs, Fork Token Degradation Matrix and Test Image Import. It runs with if: always() and needs: ${{ toJson(needs) }}, so it reports on every PR and push, and it fails if any upstream job fails or is cancelled.
• Other PR-triggered workflows live in separate files: pg-upgrade.yml, oc-runner-commands.yml and cert-expiry-tests.yml. A job can only need jobs in its own workflow, so this gate does not cover them. Requiring their job checks directly is not recommended. cert-expiry-tests.yml still uses a top-level paths filter, so its checks never appear on most PRs and would block them. PG Upgrade's container names change with the versions matrix. A clean follow-up is a results job in each of those files with a distinct name (for example PG Upgrade Results). Another option is moving them into reusable workflows called from pr-open.yml, so PR Results covers everything. Until then they stay advisory.
• probe-runner-*.yml only run on PRs that edit their own file, and pr-close.yml runs on close. Neither is gated.

Jobs that could pass by skipping (workflow-results treats skipped as passing)

• Test Deployer and Test Image Import skip on fork PRs and on pushes, because they need OpenShift credentials. A fork PR can go green without them.
• Test Crunchy, Test Image Import and Test Route TLS skip when their diff-triggers filters don't match. A wrong or too-narrow filter would let changed code skip its tests. Keep the filters in step with each job's real dependencies.
• If Path filters or Route TLS path filter fails, its dependants are skipped, but the gate still fails on the failed filter job.
• Test Route TLS logs uses !cancelled() and treats skipped upstream jobs as nothing to scan.

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

0 open findings

What changed in this PR

Adds a single “merge gate” job to aggregate and report the overall workflow result for PRs, ensuring the workflow reports a unified status even when some jobs are skipped due to path or repo filters.

Changes:

• Introduces a results job that always runs and evaluates the outcomes of dependent jobs.
• Uses bcgov/actions/workflow-results to fail the workflow if any needed job failed or was cancelled.

File	Description
.github/​workflows/​pr-open.yml	Adds an always-run results job to aggregate job outcomes into a single PR status.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.