hook up status reporting

Change-Id: I90dfc9a1da09431c8ef8807272d50ae4239affc9

calculate-buildkite-steps.py

@@ -129,6 +129,38 @@ try:
             ],
         }
         for group, items in itertools.groupby(sorted(jobs, key=Job.group), Job.group)
+    ] + [
+        {
+            'wait': '~',
+            'continue_on_failure': True,
+        },
+        {
+            # Exit with success or failure depending on whether any other steps
+            # failed (but not retried).
+            #
+            # This information is checked by querying the Buildkite REST API
+            # and counting all `failed` or `canceled` steps.
+            #
+            # This step must be :ice_cream: (yes, really!) because the post-command
+            # hook will inspect this name.
+            #
+            # Note that this step has requirements for the agent environment:
+            #
+            #  * curl and jq must be on the $PATH of build agents (enforced via nixos config)
+            #  * a buildkite secret named `build_status_token` with `read_builds` access must exist
+            'label': ':ice_cream:',
+            'command': textwrap.dedent("""
+                set -ueo pipefail
+
+                readonly FAILED_JOBS=$(curl --silent \
+                    -H "Authorization: Bearer $(buildkite-agent secret get build_status_token)" \
+                    "https://api.buildkite.com/v2/organizations/$${BUILDKITE_ORGANIZATION_SLUG}/pipelines/$${BUILDKITE_PIPELINE_SLUG}/builds/$${BUILDKITE_BUILD_NUMBER}" \
+                    | jq '.jobs | map(select(.state == "failed" or .state == "canceled")) | length')
+
+                echo "$$FAILED_JOBS build jobs failed."
+                (( $$FAILED_JOBS == 0 ))
+            """),
+        }
     ]
 
     print(json.dumps({'steps': commands}, indent=2))