feat: Shorten workflow job names, add required checks, optimize runners, and restrict permissions

.github/workflows/CI.yml

@@ -19,76 +19,103 @@
 
 jobs:
   gaptest:
-    name: Code quality - unit-tests (${{ matrix.gap-branch }})
+    name: Code - units (${{ matrix.gap-branch }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         gap-branch:
           - master
           - stable-4.15
           - stable-4.14
           - stable-4.13
           - stable-4.12
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
       - name: Setup gap-system
         uses: gap-actions/setup-gap@v3
         with:
           gap-version: ${{ matrix.gap-branch }}
 
       - name: Install additional packages
         shell: bash
         run: |
           gap -c 'LoadPackage("PackageManager"); InstallPackage("digraphs"); QUIT;'
 
       - name: Build gap-package
         uses: gap-actions/build-pkg@v2
 
       - name: Provision documentation for package
         uses: gap-actions/build-pkg-docs@v2
         with:
           use-latex: 'true'
 
       - name: Run gap-tests
         uses: gap-actions/run-pkg-tests@v4
 
       - name: Run gap-tests (only-needed)
         uses: gap-actions/run-pkg-tests@v4
         with:
           only-needed: true
 
       - name: Show code-coverage
         uses: gap-actions/process-coverage@v3
 
   gaplint:
-    name: Code quality - gaplint
+    name: Code - lint
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
       - name: Setup python
         uses: actions/setup-python@v6
         with:
           python-version: 3.13
           cache: pip
 
       - name: Install python-dependencies
         uses: py-actions/py-dependency-install@v4
         with:
           update-pip: true
 
       - name: Run gaplint
         run: |
           echo "::group:: gaplint -- *.g"
           find . -name '*.g' | xargs -n1 gaplint
           echo "::group:: gaplint -- *.gi"
           find . -name '*.gi' | xargs -n1 gaplint
           echo "::group:: gaplint -- *.gd"
           find . -name '*.gd' | xargs -n1 gaplint
           echo "::group:: gaplint -- *.tst"
           find . -name '*.tst' | xargs -n1 gaplint
+
+  required:
+    name: Required checks - pull-request
+    runs-on: ubuntu-latest
+    needs:
+      - gaptest
+      - gaplint
+
+    steps:
+      - id: status
+        name: Determine status
+        run: |
+          results=$(tr -d '\n' <<< '${{ toJSON(needs.*.result) }}')
+          if ! grep -q -v -E '(failure|cancelled)' <<< "$results"; then
+            result="failed"
+          else
+            result="success"
+          fi
+          {
+            echo "result=${result}"
+            echo "results=${results}"
+          } | tee -a "$GITHUB_OUTPUT"
+      - if: always() && steps.status.outputs.result != 'success'
+        name: Check for failed status
+        run: |
+          echo "One or more required build workflows failed: ${{ steps.status.outputs.results }}"
+          exit 1