ValidatePullRequests.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Validate Pull Request

on:
  pull_request:
    branches: [ main, 'release/**' ]

# Cancels old running job if a new one is triggered (e.g. by a push onto the same branch).
# This will cancel dependent jobs as well, such as dep_build and dep_benchmarks
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  id-token: write
  contents: read

jobs:
  # Lets later jobs skip building when a pull request only changes docs.
  docs-pr:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      docs-only: ${{ steps.docs-only.outputs.result }}
    steps:
      - id: docs-only
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          files=$(gh api --paginate "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files" --jq '.[].filename')
          if [ -n "$files" ] && ! grep -qvE '\.(md|txt)$' <<< "$files"; then
            echo "result=true" >> "$GITHUB_OUTPUT"
          else
            echo "result=false" >> "$GITHUB_OUTPUT"
          fi

  benchmarks:
    needs: docs-pr
    uses: ./.github/workflows/dep_benchmarks.yml
    secrets: inherit
    with:
      docs_only: ${{ needs.docs-pr.outputs.docs-only }}
      download-benchmarks: true
      upload-benchmarks: false

  build:
    needs: docs-pr
    uses: ./.github/workflows/dep_build.yml
    secrets: inherit
    with:
      docs_only: ${{ needs.docs-pr.outputs.docs-only }}

  code-checks:
    needs: docs-pr
    uses: ./.github/workflows/dep_code_checks.yml
    with:
      docs_only: ${{ needs.docs-pr.outputs.docs-only }}

  license-headers:
    name: check license headers
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
    - name: Check License Headers
      run: ./dev/check-license-headers.sh

  # Gate PR merges on this specific "join-job" which requires all other
  # jobs to run first.
  report-ci-status:
    needs:
      - benchmarks
      - build
      - code-checks
      - docs-pr
      - license-headers
      - spelling
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: calculate the correct exit status
        run: jq --exit-status 'all(.result == "success" or .result == "skipped")' <<< '${{ toJson(needs) }}'

  spelling:
    name: Spell check with typos
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
    - name: Spell Check Repo
      uses: crate-ci/typos@4c8b7f51ca60df14e3c5ca82770dfbbe6c3dae85 # v1.52.0