Mark test-go failed if one test failed. (#28052)

.github/workflows/test-go.yaml

@@ -54,13 +54,13 @@ jobs:
             mysql: "mysql:8.0.32" # Only run MySQL 8.0.32 tests on cron schedule
           # The suites below do not need MySQL, so we exclude additional MySQL options from the above matrix.
           - suite: "fast"
-            mysql: "mysql:8.0.36"
+            mysql: "mysql:8.0.32" # We must make sure that at least 1 instance of this suite will run, which is 8.0.36 in this case
           - suite: "fast"
             mysql: "mysql:8.4.3"
           - suite: "fast"
             mysql: "mysql:9.1.0"
           - suite: "scripts"
-            mysql: "mysql:8.0.36"
+            mysql: "mysql:8.0.32"
           - suite: "scripts"
             mysql: "mysql:8.4.3"
           - suite: "scripts"
@@ -241,6 +241,18 @@ jobs:
         name: ${{ matrix.suite }}-${{ env.MATRIX_MYSQL_ID }}-summary-test-log
         path: /tmp/summary.txt
 
+    - name: Set fail status
+      if: failure()
+      run: |
+        echo "fail" > /tmp/fail
+
+    - name: Upload fail indicator
+      if: failure()
+      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a  # v4.3.6
+      with:
+        name: ${{ matrix.suite }}-${{ env.MATRIX_MYSQL_ID }}-fail
+        path: /tmp/fail
+
   # Based on https://github.com/micromdm/nanomdm/blob/main/.github/workflows/on-push-pr.yml#L87
   test-go-nanomdm:
     runs-on: 'ubuntu-latest'
@@ -365,3 +377,28 @@ jobs:
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           flags: backend
+
+  # Our Go matrix test suites are run with continue-on-error: true, so they don't contribute to the workflow pass/fail.
+  # This job explicitly checks if any Go matrix test suites have failed and marks the overall workflow with the proper pass/fail status.
+  aggregate-result:
+    needs: upload-coverage
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: Download artifacts
+        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
+        with:
+          pattern: '*-fail'
+
+      - name: Check for failures
+        run: |
+          for dir in $(find ./ -type d -name '*-fail'); do
+            echo "Found $dir"
+            echo "❌ One or more test jobs failed."
+            exit 1
+          done
+          echo "✅ All test jobs succeeded."