diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b1d1e2..0d73baa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,7 +48,7 @@ jobs:
         run: composer install --no-interaction --no-progress
 
       - name: php -l sweep
-        run: for f in $(find src bin -name '*.php'); do php -l "$f" > /dev/null || exit 1; done && echo LINT_OK
+        run: find src bin -name '*.php' -print0 | while IFS= read -r -d '' f; do php -l "$f" > /dev/null || exit 1; done && echo LINT_OK
 
       - name: test_state
         run: php bin/test_state.php --integration
@@ -292,3 +292,20 @@ jobs:
           else
             echo "No locked dependencies to audit (platform-only package); nothing to fail on."
           fi
+
+  ci:
+    # The context master-rule requires: it reports on every run and fails when a job above failed or was
+    # cancelled. A skipped job counts as passed.
+    if: always()
+    needs: [test, conformance-pipeline, coverage, composer-audit]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Every job above succeeded or was skipped
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          echo "needs: $RESULTS"
+          for result in $RESULTS; do
+            case "$result" in failure|cancelled) exit 1 ;; esac
+          done