[skip-release] Restore required PR status gate

Author: pennypacker-he

.github/workflows/lint-test-build-push.yml

@@ -96,6 +96,16 @@ jobs:
           severity: HIGH,CRITICAL
           vuln-type: os,library
 
+  merge:
+    if: always() && github.event_name == 'pull_request'
+    needs:
+      - test
+      - image-check
+    uses: libops/.github/.github/workflows/pr-status.yaml@578137212ead4ab4059e95df17fa30e9b7ac4aed
+    permissions: {}
+    with:
+      needs-json: ${{ toJSON(needs) }}
+
   publish:
     if: github.event_name != 'pull_request'
     needs: test

ci/publication_contract_test.go

@@ -32,8 +32,12 @@ func TestPublicationUsesSharedGHCRAndGARContract(t *testing.T) {
 	workflow := readFile(t, ".github", "workflows", "lint-test-build-push.yml")
 	for _, required := range []string{
 		"libops/.github/.github/workflows/build-push.yaml@" + sharedWorkflowSHA,
+		"libops/.github/.github/workflows/pr-status.yaml@" + sharedWorkflowSHA,
 		"image-check:",
 		"if: github.event_name == 'pull_request'",
+		"if: always() && github.event_name == 'pull_request'",
+		"needs-json: ${{ toJSON(needs) }}",
+		"permissions: {}",
 		"ubuntu-24.04-arm",
 		"aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25",
 		"severity: HIGH,CRITICAL",