Add CI job for branch protection

.github/workflows/ValidatePullRequests.yml

@@ -6,18 +6,45 @@ on:
   pull_request:
     branches: [ main, 'release/**' ]
 
+# Cancels old running job if a new one is triggered (e.g. by a push onto the same branch).
+# This will cancel dependent jobs as well, such as dep_build and dep_benchmarks
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   id-token: write
   contents: read
 
 jobs:
+  spelling:
+    name: Spell check with typos
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5
+    - name: Spell Check Repo
+      uses: crate-ci/typos@v1.38.1
+
   build:
     uses: ./.github/workflows/dep_build.yml
     secrets: inherit
+
   benchmarks:
     uses: ./.github/workflows/dep_benchmarks.yml
     secrets: inherit
     with:
       download-benchmarks: true
       upload-benchmarks: false
 
+  # Gate PR merges on this specific "join-job" which requires all other
+  # jobs to run first.
+  report-ci-status:
+    needs:
+      - build
+      - benchmarks
+      - spelling
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: calculate the correct exit status
+        run: jq --exit-status 'all(.result == "success" or .result == "skipped")' <<< '${{ toJson(needs) }}'

.github/workflows/dep_build.yml

@@ -74,11 +74,6 @@ jobs:
       run: |
           just build-js-host-api ${{ matrix.config }}
 
-    - name: Spell Check Repo
-      # Only run on linux, otherwise we need to install wget on windows...
-      if: runner.os == 'Linux'
-      uses: crate-ci/typos@master
-
     - name: lint
       run: just lint ${{ matrix.config }}