Infra: Require CI checks before auto-merge

.asf.yaml

@@ -38,6 +38,21 @@ github:
       required_status_checks:
         # strict means "Require branches to be up to date before merging".
         strict: true
+        contexts:
+          # Repository policy and security checks.
+          - Analyze Actions
+          - CodeQL
+          - Run zizmor 🌈
+          - asf-allowlist-check
+          - rat
+
+          # Documentation checks.
+          - docs
+          - markdown-link-check
+
+          # Python workflow gates.
+          - python-ci-required
+          - python-integration-required
 
       required_pull_request_reviews:
         required_approving_review_count: 1

.github/workflows/check-md-link.yml

@@ -27,9 +27,6 @@ on:
     branches:
     - 'main'
   pull_request:
-    paths:
-      - '.github/workflows/check-md-link.yml'
-      - 'mkdocs/**'
   workflow_dispatch:
 
 permissions:

.github/workflows/python-ci.yml

@@ -24,19 +24,6 @@ on:
     branches:
     - 'main'
   pull_request:
-    paths:
-    - '**'                              # Include all files and directories in the repository by default.
-    - '!.github/workflows/**'           # Exclude all workflow files
-    - '.github/workflows/python-ci.yml' # except the current file.
-    - '!.github/ISSUE_TEMPLATE/**'      # Exclude files and directories that don't impact tests or code like templates, metadata, and documentation.
-    - '!.gitignore'
-    - '!.asf.yml'
-    - '!mkdocs/**'
-    - '!.gitattributes'
-    - '!README.md'
-    - '!CONTRIBUTING.md'
-    - '!LICENSE'
-    - '!NOTICE'
 
 permissions:
   contents: read
@@ -127,3 +114,17 @@ jobs:
       run: uv sync --directory . --only-group dev --no-install-project
     - name: Mirror wheel CIBW_TEST_COMMAND
       run: uv run --directory . pytest tests/avro/test_decoder.py
+
+  python-ci-required:
+    if: ${{ always() }}
+    needs: [lint-and-unit-test, windows-unit-test, cibw-dev-env-smoke-test]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Verify Python CI jobs succeeded
+      env:
+        RESULTS: ${{ join(needs.*.result, ' ') }}
+      run: |
+        read -ra results <<< "$RESULTS"
+        for result in "${results[@]}"; do
+          test "$result" = "success"
+        done

.github/workflows/python-integration.yml

@@ -24,13 +24,6 @@ on:
     branches:
     - 'main'
   pull_request:
-    paths:                                       # Only run integration tests when Python (or the code they exercise) changes.
-    - '**/*.py'
-    - 'pyproject.toml'
-    - 'uv.lock'
-    - 'Makefile'
-    - 'dev/**'                                   # docker-compose files and fixtures used by the integration suites.
-    - '.github/workflows/python-integration.yml' # this file itself.
 
 permissions:
   contents: read
@@ -183,3 +176,17 @@ jobs:
         merge-multiple: true
     - name: Generate coverage report (75%) # Coverage threshold should only increase over time — never decrease it!
       run: COVERAGE_FAIL_UNDER=75 make coverage-report
+
+  python-integration-required:
+    if: ${{ always() }}
+    needs: [integration-test, integration-test-s3, integration-test-adls, integration-test-gcs, integration-coverage-report]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Verify Python integration jobs succeeded
+      env:
+        RESULTS: ${{ join(needs.*.result, ' ') }}
+      run: |
+        read -ra results <<< "$RESULTS"
+        for result in "${results[@]}"; do
+          test "$result" = "success"
+        done