diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4896cc2..1e87698 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,6 +10,12 @@ jobs:
   required-status-checks:
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    # Wait for the `test` aggregation gate: a `needs`-gated job does not register
+    # its status context until its dependencies finish, so this guard must run
+    # after it or it races and reports `test` as missing.
+    needs:
+      - test
+    if: ${{ always() }}
     permissions:
       checks: read
       contents: read
@@ -158,15 +164,40 @@ jobs:
           grep '^changed=true$' "${GITHUB_OUTPUT}"
 
   example:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    name: test (${{ matrix.os }})
     timeout-minutes: 15
-    name: test
     permissions:
       contents: write
       pull-requests: write
+    strategy:
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./
+      - name: verify binary is accessible after action
+        run: gitignore.in --version
+
+  # Aggregation gate that produces the bare `test` status context required by
+  # the `default-branch-baseline` ruleset. The platform matrix above reports as
+  # `test (ubuntu-latest)` / `test (macos-latest)`, so this job re-exposes a
+  # single `test` context that is green only when every matrix leg succeeds.
+  test:
+    needs:
+      - example
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: example matrix succeeded on all platforms
+        run: |
+          result='${{ needs.example.result }}'
+          test "${result}" = success
 
   example-pinned-boilerplates:
     runs-on: ubuntu-latest
diff --git a/action.yml b/action.yml
index b092214..0e1cafa 100644
--- a/action.yml
+++ b/action.yml
@@ -83,7 +83,7 @@ runs:
         ref: ${{ inputs.base_branch }}
         path: repository
 
-    - uses: gitignore-in/install-gibo@9e7dba9e59f184b41f542669b0864687a6f69b45 # v0.1.0
+    - uses: gitignore-in/install-gibo@190df5cc5be7f64b8364a04f9c84e2cfa7b1cd32
       with:
         boilerplates-ref: ${{ inputs.boilerplates_ref }}
     - run: |