fix(aggregate-job-checks): a GitHub-abandoned job fails the required check as a config error

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

GitHub reported a job result of abandoned on devantler-tech/ksail#6655 (run 32902993559, 2026-08-25). The aggregator received:

JOB_RESULTS: success success skipped success abandoned skipped success ... 

and exited 1 with:

❌ CI - Required Checks — unknown job result: 'abandoned'. Allowed values: success, failure, cancelled, skipped.

aggregate-job-checks/action.yaml allows exactly success|skipped|failure|cancelled and sends everything else down the *) branch. GitHub documents those four values for needs.<job>.result, but it demonstrably emits abandoned as well, so the action can receive a value no workflow author chose and none can prevent.

In the same run the abandoned state was collateral from a genuine infrastructure transient — the runner could not resolve GitHub's own action-download host (Name or service not known (internal-api.service.iad.github.net:443)), which failed one job and left another abandoned.

Who it affects, and how

Every repository in the portfolio, because this action is the single aggregated required check that branch protection points at. When it happens, the required check goes red with a message that reads as a malformed-input bug in the calling workflow. The engineer looks for a configuration error that does not exist, while the actual correct next action — re-run the transient — is not what the message suggests.

It also costs the *) branch its meaning. That branch exists to catch a genuinely malformed job-results input, and it currently cannot be told apart from a routine GitHub-side job state.

Expected behaviour

abandoned is recognised explicitly rather than falling through to "unknown". It should still fail the check — an abandoned job did not succeed, and passing it would be the unsafe direction — but say what happened and what to do:

• name the abandoned job state as a GitHub-side outcome, not an input error;
• point at a re-run as the remedy;
• keep the *) branch reserved for values that really are unexpected, so a malformed input remains distinguishable.

Acceptance criteria

• abandoned is handled by its own branch and fails the aggregate with a message that names it as an abandoned job, distinct from the malformed-input message.
• A genuinely unrecognised value still takes the *) branch and still fails, with its existing message.
• Tests cover all three classes: an abandoned result, an unrecognised result, and the existing pass/fail cases — each asserting the exit status and which message was emitted, so the two failure paths cannot be conflated.
• The job-results input documentation records that GitHub can emit values beyond the four documented ones.

Size

Small — one case branch, its message, and the tests that keep the two failure paths apart.