From 0fa616407c1508bc3cf9c3cc8735d00e12d9086e Mon Sep 17 00:00:00 2001
From: Sviatoslav Sydorenko <wk@sydorenko.org.ua>
Date: Thu, 27 Apr 2023 01:37:56 +0200
Subject: [PATCH] =?UTF-8?q?=E2=9C=85=20Introduce=20a=20gate/check=20GHA=20?=
 =?UTF-8?q?job?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This adds a GHA job that reliably determines if all the required
dependencies have succeeded or not.

It also allows to reduce the list of required branch protection CI
statuses to just one — `check`. This reduces the maintenance burden
by a lot and have been battle-tested across a small bunch of projects
in its action form and in-house implementations of other people.

This action is now in use in aiohttp (and other aio-libs projects),
CherryPy, conda, coveragepy, Open edX, Towncrier some of the Ansible
repositories, pip-tools, all of the jaraco's projects (like
`setuptools`, `importlib_metadata`), some of hynek's projects (like
`attrs`, `structlog`), some PyCQA, PyCA, PyPA and pytest projects, a
few AWS Labs projects. Admittedly, I maintain a few of these but it
seems to address some of the pain folks have:
https://github.com/jaraco/skeleton/pull/55#issuecomment-1106638475.

I figured, this might be useful for CPython too, which is why I'm
submitting this patch.

The story behind this is explained in more detail at
https://github.com/marketplace/actions/alls-green#why.

Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>
---
 .github/workflows/build.yml | 57 +++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 34fcce445d0cd4..06551b13219c2a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -519,3 +519,60 @@ jobs:
       run: make pythoninfo
     - name: Tests
       run: xvfb-run make buildbottest TESTOPTS="-j4 -uall,-cpu"
+
+  all-required-green:  # This job does nothing and is only used for the branch protection
+    name: All required checks pass
+    if: always()
+
+    needs:
+    - check_source  # Transitive dependency, needed to access `run_tests` value
+    - check-docs
+    - check_generated_files
+    - build_win32
+    - build_win_amd64
+    - build_macos
+    - build_ubuntu
+    - build_ubuntu_ssltests
+    - test_hypothesis
+    - build_asan
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Check whether the needed jobs succeeded or failed
+      uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
+      with:
+        allowed-failures: >-
+          build_macos,
+          build_ubuntu_ssltests,
+          build_win32,
+          test_hypothesis,
+        allowed-skips: >-
+          ${{
+            !fromJSON(needs.check_source.outputs.run-docs)
+            && '
+            check-docs,
+            '
+            || ''
+          }}
+          ${{
+            needs.check_source.outputs.run_tests != 'true'
+            && '
+            check_generated_files,
+            build_win32,
+            build_win_amd64,
+            build_macos,
+            build_ubuntu,
+            build_ubuntu_ssltests,
+            build_asan,
+            '
+            || ''
+          }}
+          ${{
+            !fromJSON(needs.check_source.outputs.run_hypothesis)
+            && '
+            test_hypothesis,
+            '
+            || ''
+          }}
+        jobs: ${{ toJSON(needs) }}