diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index f629f93314..81fb93701b 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -70,6 +70,8 @@ jobs:
   core-checks:
     needs: install-core
     runs-on: ubuntu-latest
+    # Tests requiring secrets need approval from maintainers
+    environment: ${{ github.event.pull_request.head.repo.fork && 'tests-requiring-secrets' || '' }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -97,7 +99,7 @@ jobs:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
 
   install-gui:
-    needs: [ install-root, install-core ]
+    needs: [install-root, install-core]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -158,7 +160,7 @@ jobs:
           npx tsc --noEmit
 
   binary-checks:
-    needs: [ install-root, install-core ]
+    needs: [install-root, install-core]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -194,7 +196,7 @@ jobs:
           npx tsc --noEmit
 
   install-vscode:
-    needs: [ install-root, install-core ]
+    needs: [install-root, install-core]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -283,7 +285,7 @@ jobs:
 
   vscode-get-test-file-matrix:
     runs-on: ubuntu-latest
-    needs: [ install-root, install-vscode ]
+    needs: [install-root, install-vscode]
     outputs:
       test_file_matrix: ${{ steps.vscode-get-test-file-matrix.outputs.test_file_matrix }}
     steps:
@@ -312,7 +314,7 @@ jobs:
 
   vscode-package-extension:
     runs-on: ubuntu-latest
-    needs: [ install-vscode, install-core ]
+    needs: [install-vscode, install-core]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -344,7 +346,7 @@ jobs:
 
   vscode-download-e2e-dependencies:
     runs-on: ubuntu-latest
-    needs: [ install-vscode, install-core ]
+    needs: [install-vscode, install-core]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -386,11 +388,13 @@ jobs:
         install-core,
       ]
     runs-on: ubuntu-latest
+    # Tests requiring secrets need approval from maintainers
+    environment: ${{ github.event.pull_request.head.repo.fork && 'tests-requiring-secrets' || '' }}
     strategy:
       fail-fast: false
       matrix:
         test_file: ${{ fromJson(needs.vscode-get-test-file-matrix.outputs.test_file_matrix) }}
-        command: [ "e2e:ci:run", "e2e:ci:run-yaml" ]
+        command: ["e2e:ci:run", "e2e:ci:run-yaml"]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -451,7 +455,7 @@ jobs:
           path: extensions/vscode/e2e/storage/screenshots
 
   gui-tests:
-    needs: [ install-gui, install-core ]
+    needs: [install-gui, install-core]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -482,7 +486,7 @@ jobs:
           npm test
 
   jetbrains-tests:
-    needs: [ install-root, core-checks ]
+    needs: [install-root, core-checks]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -578,4 +582,35 @@ jobs:
         with:
           name: jb-failure-report
           path: |
-            ${{ github.workspace }}/extensions/intellij/build/reports
\ No newline at end of file
+            ${{ github.workspace }}/extensions/intellij/build/reports
+
+  # GitHub does not have a way of requiring that all checks pass (you must manually select each job)
+  # This action at least lets us manage the list of required tests via source control
+  # so that creators of new jobs can add them to this list
+  require-all-checks-to-pass:
+    if: always()
+    runs-on: ubuntu-latest
+    needs:
+      - install-root
+      - install-core
+      - core-checks
+      - install-gui
+      - gui-checks
+      - binary-checks
+      - install-vscode
+      - vscode-checks
+      - core-tests
+      - vscode-get-test-file-matrix
+      - vscode-package-extension
+      - vscode-download-e2e-dependencies
+      - vscode-e2e-tests
+      - gui-tests
+      - jetbrains-tests
+
+    steps:
+      - name: Decide whether the needed jobs succeeded or failed
+        uses: re-actors/alls-green@release/v1
+        with:
+          allowed-failures:
+          allowed-skips:
+          jobs: ${{ toJSON(needs) }}