ci: one workflow runs only the checks a PR can affect, and alls-green is the one required check

Merged
HA
6d ago
+401-361

GitHub leaves a required check pending forever when a path filter skips its workflow. So the path-filtered workflows (frontend CI, docs, stack tests) couldn't be required, and the rest (ruff, mypy, grimp, bandit, generated API) ran on every PR, a docs typo included.

This does what FastAPI, pydantic, CPython and Vite do. There's one CI workflow. Its first job runs dorny/paths-filter to decide which jobs the PR needs, and its last job, All checks pass, runs re-actors/alls-green, which counts a skipped job as passed and a failed or cancelled one as failed. That last job is the only check main will require.

stack-tests.yml becomes ci.yml and takes in the jobs of ruff.yml, mypy.yml, grimp.yml, security.yml, frontend-ci.yml, generated-api.yml and docs.yml, which are deleted. On a PR:

  • backend/ runs ruff, mypy, grimp, bandit and the backend unit tests
  • frontend/ runs the frontend lint, type check and unit tests
  • any app or stack file builds the images and runs frontend E2E; backend E2E skips a frontend-only PR
  • the generated API check runs for the backend, the spec, the client or its generator config
  • the docs build runs for the docs, and for the backend and frontend, since the docs include snippets of them

Editing ci.yml runs every job, and so does every push to main, which keeps the image build and Docker Scan & Promote (now triggered by CI) as before. The SBOM scan only reports, so it stays its own workflow and runs on PRs that change a dependency manifest. The README badges now show the CI jobs by name, and the CI/CD doc describes the gate, the ruleset and stacks.

actionlint passes on the changed workflows, and mkdocs build --strict passes locally.

Summary by cubic

Consolidates the seven check workflows into one CI workflow that runs only the jobs a PR can affect, so a skipped job counts as passed and All checks pass is the only required check.

  • dorny/paths-filter decides which jobs run, and re-actors/alls-green fails the run only on a failed or cancelled job — the same pattern FastAPI, pydantic and CPython use.
  • Backend changes run ruff, mypy, grimp, bandit and the backend unit tests; frontend changes run the frontend lint, type check and unit tests; docs also run for backend and frontend changes, since the docs include snippets of them.
  • stack-tests.yml becomes ci.yml, the seven deleted workflows fold into it, and Docker Scan & Promote now triggers off CI.
  • Pushes to main and edits to ci.yml itself run every job; the SBOM scan stays a separate report-only workflow and runs only when a dependency manifest changes.