ci: aggregate gate job + branch-0.4 required checks for spark-runtime

.asf.yaml

@@ -35,6 +35,17 @@ github:
     main:
       required_pull_request_reviews:
         required_approving_review_count: 1
+    # NOTE: ASF applies these github settings only from the default branch's
+    # .asf.yaml (main), so this branch-0.4 block documents the intended
+    # protection but takes effect via main's .asf.yaml, not this file.
+    branch-0.4:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+      required_status_checks:
+        contexts:
+          - "Maven CI Build"
+          - "License Check"
+          - "spark-runtime-validation-required"
 notifications:
     commits:      commits@xtable.apache.org
     issues:       commits@xtable.apache.org

.github/workflows/spark-runtime-validation.yml

@@ -91,3 +91,21 @@ jobs:
         env:
           SPARK_LOCAL_IP: "127.0.0.1"
         run: ./mvnw verify -ntp -B -pl xtable-spark-runtime
+
+  # Single stable status context that aggregates every matrix leg, so branch
+  # protection can require one check name instead of listing each Spark version.
+  # `if: always()` is required: without it this job is skipped when a leg fails,
+  # and a skipped required check leaves the PR stuck on a pending status.
+  spark-runtime-validation-required:
+    needs: validate-spark-runtime-bundle
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all spark-runtime matrix legs to pass
+        run: |
+          result="${{ needs.validate-spark-runtime-bundle.result }}"
+          echo "Aggregated validate-spark-runtime-bundle matrix result: ${result}"
+          if [[ "${result}" != "success" ]]; then
+            echo "One or more validate-spark-runtime-bundle matrix legs did not succeed."
+            exit 1
+          fi