diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b8b223..77dab90 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -209,6 +209,29 @@ jobs:
       - name: Duplicate code stays under the threshold
         run: npx --yes jscpd@5.4.1
 
+  all-green:
+    # The one check the branch ruleset requires from this workflow, next to
+    # the separate "API Compatibility" workflow. Add every new job here to
+    # `needs`. A job skipped because a job it needs failed (Unit Tests after
+    # Lint & Type Check) fails the gate. No job skips by design today, so
+    # there is no `allowed-skips`.
+    name: All green
+    if: always()
+    needs:
+      - secrets-scan
+      - lint-actions
+      - lint
+      - test
+      - examples-check
+      - deptry
+      - duplication
+      - aauth
+    runs-on: ubuntu-latest
+    steps:
+      - uses: re-actors/alls-green@release/v1
+        with:
+          jobs: ${{ toJSON(needs) }}
+
   aauth:
     # packages/introspection-aauth is its own distribution, with its own
     # lock, coverage floor and duplicate-code check (its pyproject.toml and
diff --git a/AGENTS.md b/AGENTS.md
index c760c65..84215b5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -253,6 +253,16 @@ config's `ignore` list: `introspection_sdk/_sync/` is there because it
 repeats `introspection_sdk/_async/` by construction (see "Sync code
 generation"), and counting it would hide every new copy.
 
+## CI
+
+The `All green` job in `ci.yml` passes only when every other `ci.yml` job
+succeeded. The branch rulesets require just two checks: `All green` and
+`API Compatibility`, which stays its own workflow (`api-compat.yml`). So a
+new `ci.yml` job is not required until you add its id to `needs` of
+`all-green`; do that in the same PR. Add it to `allowed-skips` as well only
+when the job skips by design (it has an `if:`), never to let a skipped job
+through after a failure.
+
 ## When in doubt
 
 Read the coverage ratchet in `pyproject.toml`.