ci: gate pull requests on a single Build Success check

.github/workflows/tests.yaml → .github/workflows/ci.yaml

@@ -1,19 +1,23 @@
 ---
 # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: Tests
+name: CI
 
 on:
   push:
     branches:
       - main
+    paths-ignore:
+      - "**.md"
+      - ".release-please-manifest.json"
   pull_request:
     branches:
       - main
+  merge_group:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
@@ -27,7 +31,7 @@ jobs:
     if: >-
       ${{ !(startsWith(github.head_ref, 'release-please--')
       && github.event.pull_request.head.repo.full_name == github.repository) }}
-    name: Detect Changed Charts
+    name: Changed
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -60,8 +64,64 @@ jobs:
           fi
           echo "charts=${charts}" >> "$GITHUB_OUTPUT"
 
-  helm-test:
-    name: Helm Unit Tests (${{ matrix.chart }})
+  helm-e2e:
+    name: Helm E2E (${{ matrix.chart }})
+    needs: changed
+    if: ${{ github.event_name != 'push' && needs.changed.outputs.charts != '[]' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        chart: ${{ fromJSON(needs.changed.outputs.charts) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Mise
+        uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
+        with:
+          experimental: true
+          install_args: --locked
+
+      - name: Run e2e install tests
+        env:
+          CHARTS: charts/${{ matrix.chart }}
+        run: mise run e2e
+
+  helm-lint:
+    name: Helm Lint (${{ matrix.chart }})
+    needs: changed
+    if: ${{ needs.changed.outputs.charts != '[]' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        chart: ${{ fromJSON(needs.changed.outputs.charts) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Mise
+        uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
+        with:
+          experimental: true
+          install_args: --locked
+
+      - name: Run helm lint
+        env:
+          CHARTS: charts/${{ matrix.chart }}
+        run: mise run helm-lint
+
+  helm-unittest:
+    name: Helm Unittest (${{ matrix.chart }})
     needs: changed
     if: ${{ needs.changed.outputs.charts != '[]' }}
     runs-on: ubuntu-24.04
@@ -91,7 +151,7 @@ jobs:
           mise run helm-test
 
   # Repo-wide gates: generated docs and the vendir lock must always be current.
-  checks:
+  repo-checks:
     if: >-
       ${{ !(startsWith(github.head_ref, 'release-please--')
       && github.event.pull_request.head.repo.full_name == github.repository) }}
@@ -116,3 +176,25 @@ jobs:
 
       - name: Check vendir lock is current
         run: mise run crds-check
+
+  status:
+    if: ${{ !cancelled() }}
+    name: Build Success
+    needs:
+      - changed
+      - helm-e2e
+      - helm-lint
+      - helm-unittest
+      - repo-checks
+    runs-on: ubuntu-24.04
+    permissions: {}
+    steps:
+      - name: Any jobs failed?
+        if: ${{ contains(needs.*.result, 'failure') }}
+        run: |
+          exit 1
+
+      - name: All jobs passed or skipped?
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: |
+          echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"