title: How to run a job after MR is approved, but reject MR, if the job failed?
body: <p>I would like some automated checks were done after MR is approved, because for those checks pipeline has to access protected variables.</p>
  <p>If these checks fail, MR should be rejected.</p>
  <p>In other words the desired sequence should be this:</p>
  <p>MR created -&gt; build -&gt; run tests -&gt; MR approved (no malicious exposure of protected variables)-&gt; merged to protected branch -&gt; run checks -&gt; rollback on failure.</p>
  <p>Is this possible?</p>