ci: add an aggregate status check and name every job

Required status checks are matched by literal context string, and the ruleset
on dev names four of them directly: test (3.10) through test (3.13). Two
consequences. Renaming a job orphans a required check, which then waits
forever for a name nothing reports. And the list drifts: 3.14 is in the matrix
but not in the ruleset, so it has been non-blocking since it was added.

Add a single `all checks passed` job that depends on the matrix. The ruleset
can require that one context instead, leaving the matrix and the job names as
repo-side concerns.

Also name every job after what it does, which is safe to do in the same change
now that no required context points at a matrix job:

  test                      -> run test suite on python 3.10
  publish_code              -> publish package and docker images
  tag_commit                -> tag the release commit
  publish_docs              -> publish the docs site
  test-distros              -> install and smoke-test on fedora
  analyze                   -> scan python for security issues
  benchmark                 -> compare performance against the base branch
  cla                       -> check the CLA is signed
  update_docs               -> regenerate the docs and open a PR
  update-nuclei-version     -> open a PR when a new nuclei is released
  update-trufflehog-version -> open a PR when a new trufflehog is released

This must merge before the ruleset is updated: a context is not selectable as
a required check until it has reported at least once. Merging this alone
changes nothing, the old required checks keep gating dev. The ruleset edit is
a separate admin step, described in the PR.

Author: singlerider

.github/workflows/benchmark.yml

@@ -17,6 +17,7 @@ permissions:
 
 jobs:
   benchmark:
+    name: compare performance against the base branch
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/cla.yml

@@ -11,5 +11,6 @@ permissions:
 
 jobs:
   cla:
+    name: check the CLA is signed
     uses: blacklanternsecurity/CLA/.github/workflows/cla-reusable.yml@main
     secrets: inherit

.github/workflows/codeql.yml

@@ -21,7 +21,7 @@ on:
 
 jobs:
   analyze:
-    name: Analyze (${{ matrix.language }})
+    name: scan ${{ matrix.language }} for security issues
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
     #   - https://gh.io/supported-runners-and-hardware-resources

.github/workflows/distro_tests.yml

@@ -8,6 +8,7 @@ concurrency:
 
 jobs:
   test-distros:
+    name: install and smoke-test on ${{ matrix.os }}
     runs-on: ubuntu-latest
     container:
       image: ${{ matrix.os }}

.github/workflows/docs_updater.yml

@@ -7,6 +7,7 @@ on:
 
 jobs:
   update_docs:
+    name: regenerate the docs and open a PR
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7

.github/workflows/tests.yml

@@ -12,6 +12,7 @@ concurrency:
 
 jobs:
   test:
+    name: run test suite on python ${{ matrix.python-version }}
     runs-on: ubuntu-latest
     strategy:
       # if one python version fails, let the others finish
@@ -51,7 +52,26 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./cov.xml
           verbose: true
+
+  # Single required status check. The ruleset requires this one context instead
+  # of naming each matrix job, so changing the matrix or renaming a job becomes
+  # a repo-side change that cannot orphan a required check.
+  #
+  # `if: always()` plus alls-green is deliberate: a bare `needs:` gate reports
+  # success when a dependency is skipped or cancelled.
+  all_checks:
+    name: all checks passed
+    if: always()
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail unless every dependency succeeded
+        uses: re-actors/alls-green@release/v1
+        with:
+          jobs: ${{ toJSON(needs) }}
+
   publish_code:
+    name: publish package and docker images
     needs: test
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/stable')
@@ -200,6 +220,7 @@ jobs:
     outputs:
       BBOT_VERSION: ${{ steps.version.outputs.BBOT_VERSION }}
   tag_commit:
+    name: tag the release commit
     needs: publish_code
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && (github.ref == 'refs/heads/stable' || github.ref == 'refs/heads/dev')
@@ -222,6 +243,7 @@ jobs:
           git push origin "$VERSION"
 
   publish_docs:
+    name: publish the docs site
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && (github.ref == 'refs/heads/stable' || github.ref == 'refs/heads/dev')
     steps:

.github/workflows/version_updater.yml

@@ -7,6 +7,7 @@ on:
 
 jobs:
   update-nuclei-version:
+    name: open a PR when a new nuclei is released
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -59,6 +60,7 @@ jobs:
           author: blsaccess <info@blacklanternsecurity.com>
           assignees: "TheTechromancer"
   update-trufflehog-version:
+    name: open a PR when a new trufflehog is released
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7