From 2ba247e09c256f1dcb1f920a1913dcac8b66de27 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexis=20M=C3=A9taireau?= <alexis@freedom.press>
Date: Thu, 17 Oct 2024 16:53:42 +0200
Subject: [PATCH] CI: Only run the CI on pull requests, and on the "main"
 branch

Previously, the actions were duplicated, due to the fact when developing
we often create feature branches and open pull requests.

This new setup requires us to open pull requests to trigger the CI.
---
 .github/workflows/build.yml      |  2 +-
 .github/workflows/check_push.yml |  2 +-
 .github/workflows/ci.yml         | 51 ++++++++++++++++++++++++++++----
 .github/workflows/scan.yml       |  3 +-
 4 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 64c5d55..a3c7474 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,6 +1,6 @@
 name: Build dev environments
 on:
-  push:
+  pull_request:
   schedule:
     - cron: "0 0 * * *" # Run every day at 00:00 UTC.
 
diff --git a/.github/workflows/check_push.yml b/.github/workflows/check_push.yml
index 0b92efc..588ef48 100644
--- a/.github/workflows/check_push.yml
+++ b/.github/workflows/check_push.yml
@@ -1,6 +1,6 @@
 name: Check branch conformity
 on:
-  push:
+  pull_request:
 
 jobs:
   prevent-fixup-commits:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0eb8805..62e290c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,8 +1,9 @@
 name: Tests
 on:
   push:
+    branches:
+      - main
   pull_request:
-    branches: [main]
   schedule:
     - cron: "2 0 * * *" # Run every day at 02:00 UTC.
   workflow_dispatch:
@@ -24,7 +25,24 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  should-run:
+    runs-on: ubuntu-latest
+    outputs:
+      run-workflow: ${{ steps.check.outputs.run-workflow }}
+    steps:
+      - id: check
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "run-workflow=true" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" != "refs/heads/main" ]]; then
+            echo "run-workflow=true" >> $GITHUB_OUTPUT
+          else
+            echo "run-workflow=false" >> $GITHUB_OUTPUT
+          fi
+
   run-lint:
+    needs: should-run
+    if: needs.should-run.outputs.run-workflow == 'true'
     runs-on: ubuntu-latest
     container:
       image: debian:bookworm
@@ -43,6 +61,8 @@ jobs:
   # This is already built daily by the "build.yml" file
   # But we also want to include this in the checks that run on each push.
   build-container-image:
+    needs: should-run
+    if: needs.should-run.outputs.run-workflow == 'true'
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
@@ -67,6 +87,8 @@ jobs:
           python3 ./install/common/build-image.py
 
   download-tessdata:
+    needs: should-run
+    if: needs.should-run.outputs.run-workflow == 'true'
     name: Download and cache Tesseract data
     runs-on: ubuntu-latest
     steps:
@@ -91,7 +113,10 @@ jobs:
 
   windows:
     runs-on: windows-latest
-    needs: download-tessdata
+    needs:
+      - download-tessdata
+      - should-run
+    if: needs.should-run.outputs.run-workflow == 'true'
     env:
       DUMMY_CONVERSION: 1
     steps:
@@ -121,7 +146,10 @@ jobs:
   macOS:
     name: "macOS (${{ matrix.arch }})"
     runs-on: ${{ matrix.runner }}
-    needs: download-tessdata
+    needs:
+      - download-tessdata
+      - should-run
+    if: needs.should-run.outputs.run-workflow == 'true'
     strategy:
       matrix:
         include:
@@ -149,9 +177,12 @@ jobs:
         run: poetry run make test
 
   build-deb:
+    needs:
+      - should-run
+      - build-container-image
+    if: needs.should-run.outputs.run-workflow == 'true'
     name: "build-deb (${{ matrix.distro }} ${{ matrix.version }})"
     runs-on: ubuntu-latest
-    needs: build-container-image
     strategy:
       matrix:
         include:
@@ -221,7 +252,10 @@ jobs:
   install-deb:
     name: "install-deb (${{ matrix.distro }} ${{ matrix.version }})"
     runs-on: ubuntu-latest
-    needs: build-deb
+    needs: 
+      - build-deb
+      - should-run
+    if: needs.should-run.outputs.run-workflow == 'true'
     strategy:
       matrix:
         include:
@@ -277,7 +311,10 @@ jobs:
   build-install-rpm:
     name: "build-install-rpm (${{ matrix.distro }} ${{matrix.version}})"
     runs-on: ubuntu-latest
-    needs: build-container-image
+    needs:
+      - build-container-image
+      - should-run
+    if: needs.should-run.outputs.run-workflow == 'true'
     strategy:
       matrix:
         distro: ["fedora"]
@@ -343,6 +380,8 @@ jobs:
     needs:
       - build-container-image
       - download-tessdata
+      - should-run
+    if: needs.should-run.outputs.run-workflow == 'true'
     strategy:
       matrix:
         include:
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index 7607f1d..d9f397b 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -1,8 +1,9 @@
 name: Scan latest app and container
 on:
   push:
+    branches:
+      - main
   pull_request:
-    branches: [ main ]
   schedule:
     - cron: '0 0 * * *' # Run every day at 00:00 UTC.
   workflow_dispatch: