Run validation job on failure

.github/workflows/__unsupported-macos.yml

@@ -80,7 +80,7 @@ jobs:
       CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
       CODEQL_ACTION_TEST_MODE: true
   unsupported-macos-sarif-checks:
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: github.triggering_actor != 'dependabot[bot]' && failure()
     needs:
       - unsupported-macos
     permissions:

pr-checks/checks/unsupported-macos.yml

@@ -33,6 +33,7 @@ validationJobs:
   unsupported-macos-sarif-checks:
     checkout: true
     installNode: true
+    if: failure()
     steps:
       - name: Download workflow artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

pr-checks/sync.ts

@@ -124,6 +124,8 @@ interface JobSpecification {
 
 type ValidationJobSpecification = JobSpecification & {
   checkout?: boolean;
+  /** Optional condition for the validation job. */
+  if?: string;
 };
 
 /** Describes language/framework-specific steps and inputs. */
@@ -640,9 +642,14 @@ function generateValidationJob(
   // Add the generated steps in front of the ones from the specification.
   specSteps.items.unshift(...checkoutStep, ...steps);
 
+  const baseCondition = "github.triggering_actor != 'dependabot[bot]'";
+
   const validationJob: Record<string, any> = {
     name: jobSpecification.name,
-    if: "github.triggering_actor != 'dependabot[bot]'",
+    if:
+      jobSpecification.if !== undefined
+        ? `${baseCondition} && ${jobSpecification.if}`
+        : baseCondition,
     needs: [checkName],
     permissions: {
       contents: "read",