From 95ef33a102991e3fdd181391229ea2dd875b107f Mon Sep 17 00:00:00 2001
From: Jirka Borovec <6035284+Borda@users.noreply.github.com>
Date: Tue, 6 Jan 2026 17:28:33 +0100
Subject: [PATCH] Add testing-guardian job to aggregate test results (#2037)

* Add testing-guardian job to aggregate test results
* Potential fix for code scanning alert no. 2: Workflow does not contain permissions
* Apply suggestions from code review

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/uv-test.yml | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/uv-test.yml b/.github/workflows/uv-test.yml
index 858a507a..3b0d5b98 100644
--- a/.github/workflows/uv-test.yml
+++ b/.github/workflows/uv-test.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main, develop]
 
+permissions:
+  contents: read
+
 concurrency:
   group: pytest-test-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -30,7 +33,6 @@ jobs:
           python-version: ${{ matrix.python-version }}
           activate-environment: true
 
-
       - name: 🚀 Install Packages
         run: uv pip install -r pyproject.toml --group dev --group docs --extra metrics
 
@@ -39,3 +41,25 @@ jobs:
 
       - name: 🧪 Run the Test
         run: uv run pytest
+
+
+  testing-guardian:
+    runs-on: ubuntu-latest
+    needs: run-tests
+    if: always()
+    steps:
+      - name: Display test result
+        run: echo "${{ needs.run-tests.result }}"
+      - name: Fail guardian on test failure
+        if: needs.run-tests.result == 'failure'
+        run: exit 1
+      # Ensure that cancelled or skipped test runs still cause this guardian job to fail,
+      # using an explicit exit code instead of relying on timeout behavior.
+      - name: cancelled or skipped...
+        if: contains(fromJSON('["cancelled", "skipped"]'), needs.run-tests.result)
+        run: |
+          echo "run-tests job result is '${{ needs.run-tests.result }}'; failing explicitly."
+          exit 1
+      - name: tests succeeded
+        if: needs.run-tests.result == 'success'
+        run: echo "All tests completed successfully in job 'run-tests'."