Silent CI Misconfiguration Let Failing PRs Merge Unblocked for Five Weeks

A software team discovered that their branch protection rules had stopped enforcing required status checks for five weeks, allowing pull requests with failing integration tests to merge without any override. The issue began when an OS matrix was added to a CI job, causing GitHub to report new job names that no longer matched the bare job name specified in branch protection settings. Because the originally required check never reported a status, every PR sat stuck in a 'waiting for status' state until a team member removed the outdated rule under pressure, unknowingly disabling enforcement entirely. The team fixed the problem by introducing a single sentinel job called 'ci-required' that depends on all other workflow jobs and is the only check named in branch protection, ensuring job renames or matrix changes never silently break enforcement. They also added a scheduled workflow that calls the branch protection API to verify the required-check list remains correct, catching at least one unintended change since its introduction.