From cba6f7b8515729d3014ad198139f9d92f763531a Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 19 Oct 2026 12:04:51 +0100
Subject: [PATCH] Run validation job on failure

---
 .github/workflows/__unsupported-macos.yml | 2 +-
 pr-checks/checks/unsupported-macos.yml    | 1 +
 pr-checks/sync.ts                         | 9 ++++++++-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/__unsupported-macos.yml b/.github/workflows/__unsupported-macos.yml
index fabd42d2c..271f844d5 100644
--- a/.github/workflows/__unsupported-macos.yml
+++ b/.github/workflows/__unsupported-macos.yml
@@ -80,7 +80,7 @@ jobs:
       CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
       CODEQL_ACTION_TEST_MODE: true
   unsupported-macos-sarif-checks:
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: github.triggering_actor != 'dependabot[bot]' && failure()
     needs:
       - unsupported-macos
     permissions:
diff --git a/pr-checks/checks/unsupported-macos.yml b/pr-checks/checks/unsupported-macos.yml
index dec7933e5..6f075c3da 100644
--- a/pr-checks/checks/unsupported-macos.yml
+++ b/pr-checks/checks/unsupported-macos.yml
@@ -33,6 +33,7 @@ validationJobs:
   unsupported-macos-sarif-checks:
     checkout: true
     installNode: true
+    if: failure()
     steps:
       - name: Download workflow artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 57fa3cab3..4c4067403 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -124,6 +124,8 @@ interface JobSpecification {
 
 type ValidationJobSpecification = JobSpecification & {
   checkout?: boolean;
+  /** Optional condition for the validation job. */
+  if?: string;
 };
 
 /** Describes language/framework-specific steps and inputs. */
@@ -640,9 +642,14 @@ function generateValidationJob(
   // Add the generated steps in front of the ones from the specification.
   specSteps.items.unshift(...checkoutStep, ...steps);
 
+  const baseCondition = "github.triggering_actor != 'dependabot[bot]'";
+
   const validationJob: Record<string, any> = {
     name: jobSpecification.name,
-    if: "github.triggering_actor != 'dependabot[bot]'",
+    if:
+      jobSpecification.if !== undefined
+        ? `${baseCondition} && ${jobSpecification.if}`
+        : baseCondition,
     needs: [checkName],
     permissions: {
       contents: "read",