Infra: Add stable required CI gates

Author: kevinjqliu

.asf.yaml

@@ -50,21 +50,9 @@ github:
           - docs
           - markdown-link-check
 
-          # Python CI checks.
-          - cibw-dev-env-smoke-test
-          - lint-and-unit-test (3.10)
-          - lint-and-unit-test (3.11)
-          - lint-and-unit-test (3.12)
-          - lint-and-unit-test (3.13)
-          - lint-and-unit-test (3.14)
-          - windows-unit-test (3.12)
-
-          # Python integration checks.
-          - integration-coverage-report
-          - integration-test
-          - integration-test-adls
-          - integration-test-gcs
-          - integration-test-s3
+          # Python workflow gates.
+          - python-ci-required
+          - python-integration-required
 
       required_pull_request_reviews:
         required_approving_review_count: 1

.github/workflows/asf-allowlist-check.yml

@@ -24,6 +24,7 @@
 name: "ASF Allowlist Check"
 
 on:
+  # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely.
   pull_request:
   push:
     branches:

.github/workflows/check-md-link.yml

@@ -26,6 +26,7 @@ on:
       - 'mkdocs/**'
     branches:
     - 'main'
+  # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely.
   pull_request:
   workflow_dispatch:
 

.github/workflows/codeql.yml

@@ -22,6 +22,7 @@ name: "CodeQL"
 on:
   push:
     branches: [ "main" ]
+  # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely.
   pull_request:
     branches: [ "main" ]
   schedule:

.github/workflows/license_check.yml

@@ -18,6 +18,7 @@
 #
 
 name: "Run License Check"
+# Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely.
 on: pull_request
 
 permissions:

.github/workflows/python-ci-docs.yml

@@ -23,6 +23,7 @@ on:
   push:
     branches:
       - 'main'
+  # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely.
   pull_request:
 
 permissions:

.github/workflows/python-ci.yml

@@ -23,6 +23,7 @@ on:
   push:
     branches:
     - 'main'
+  # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely.
   pull_request:
 
 permissions:
@@ -114,3 +115,17 @@ jobs:
       run: uv sync --directory . --only-group dev --no-install-project
     - name: Mirror wheel CIBW_TEST_COMMAND
       run: uv run --directory . pytest tests/avro/test_decoder.py
+
+  python-ci-required:
+    if: ${{ always() }}
+    needs: [lint-and-unit-test, windows-unit-test, cibw-dev-env-smoke-test]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Verify Python CI jobs succeeded
+      env:
+        RESULTS: ${{ join(needs.*.result, ' ') }}
+      run: |
+        read -ra results <<< "$RESULTS"
+        for result in "${results[@]}"; do
+          test "$result" = "success"
+        done

.github/workflows/python-integration.yml

@@ -23,6 +23,7 @@ on:
   push:
     branches:
     - 'main'
+  # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely.
   pull_request:
 
 permissions:
@@ -176,3 +177,17 @@ jobs:
         merge-multiple: true
     - name: Generate coverage report (75%) # Coverage threshold should only increase over time — never decrease it!
       run: COVERAGE_FAIL_UNDER=75 make coverage-report
+
+  python-integration-required:
+    if: ${{ always() }}
+    needs: [integration-test, integration-test-s3, integration-test-adls, integration-test-gcs, integration-coverage-report]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Verify Python integration jobs succeeded
+      env:
+        RESULTS: ${{ join(needs.*.result, ' ') }}
+      run: |
+        read -ra results <<< "$RESULTS"
+        for result in "${results[@]}"; do
+          test "$result" = "success"
+        done

.github/workflows/zizmor.yml

@@ -22,6 +22,7 @@ name: GitHub Actions Security Analysis with zizmor 🌈
 on:
   push:
     branches: ["main"]
+  # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely.
   pull_request:
     branches: ["**"]