ci: Add a rule to prevent push when ci build failure

(To be discussed)

---

Migrated from T2012 (view on Phabricator)