address feedback

Author: sean-breen

.github/scripts/validate-workflow-gating.sh

@@ -110,16 +110,19 @@ main() {
 
       if ! validate_if_condition "$job_name" "$if_cond"; then
         if [ "$file_has_errors" -eq 0 ]; then
-          echo "    ❌ File '$file' has ungated or poorly gated jobs:"
+          # Blank line separates each file's group of errors for readability.
+          echo ""
+          echo "❌ File '$file' has ungated or poorly gated jobs:"
           file_has_errors=1
         fi
         errors=$((errors + 1))
       fi
     done <<<"$jobs_data"
   done
 
-  if [ "$errors" -gt 0 ]; then
-    echo " ❌ Workflow validation failed! Found ${errors} issues."
+  if [ "$errors" -ne 0 ]; then
+    echo ""
+    echo "❌ Workflow validation failed! Found ${errors} issues."
     exit 1
   else
     echo "✅ All public workflows are successfully gated."

.github/workflows/ci.yml

@@ -111,6 +111,7 @@ jobs:
           client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
+        if: ${{ steps.vars.outputs.forked_workflow == 'false' }}
 
       - name: Setup secrets
         id: secrets
@@ -122,6 +123,7 @@ jobs:
           GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
           echo "::add-mask::$GCR_SERVICE_ACCOUNT"
           echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
+        if: ${{ steps.vars.outputs.forked_workflow == 'false' }}
 
       - name: Authenticate to Google Cloud
         id: auth
@@ -130,13 +132,15 @@ jobs:
           token_format: access_token
           workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
           service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
+        if: ${{ steps.vars.outputs.forked_workflow == 'false' }}
 
       - name: Login to GCR
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: gcr.io
           username: oauth2accesstoken
           password: ${{ steps.auth.outputs.access_token }}
+        if: ${{ steps.vars.outputs.forked_workflow == 'false' }}
 
       - name: Check if stable image exists
         id: stable_exists
@@ -146,6 +150,7 @@ jobs:
             exists=true
           fi
           echo "exists=${exists}" >> $GITHUB_OUTPUT
+        if: ${{ steps.vars.outputs.forked_workflow == 'false' }}
 
       - name: Check if docker build is needed
         id: docker_build
@@ -268,6 +273,7 @@ jobs:
           client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
+        if: ${{ needs.checks.outputs.forked_workflow == 'false' }}
 
       - name: Setup secrets
         id: secrets
@@ -276,6 +282,7 @@ jobs:
           CODECOV_TOKEN=$(az keyvault secret show --name code-cov --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
           echo "::add-mask::$CODECOV_TOKEN"
           echo "CODECOV_TOKEN=$CODECOV_TOKEN" >> $GITHUB_OUTPUT
+        if: ${{ needs.checks.outputs.forked_workflow == 'false' }}
 
       - name: Setup Golang Environment
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
@@ -294,6 +301,7 @@ jobs:
         with:
           files: ./coverage.txt
           token: ${{ steps.secrets.outputs.CODECOV_TOKEN }} # required
+        if: ${{ needs.checks.outputs.forked_workflow == 'false' }}
 
   staticcheck:
     name: Static Check
@@ -364,7 +372,10 @@ jobs:
       github.repository == 'nginx/kubernetes-ingress' && (
       !cancelled() &&
       needs.checks.result == 'success' &&
-      (needs.unit-tests.result == 'success' || needs.unit-tests.result == 'skipped'))
+      (needs.unit-tests.result == 'success' || needs.unit-tests.result == 'skipped') &&
+      (inputs.force ||
+      needs.checks.outputs.run_tests == 'true' ||
+      needs.checks.outputs.docker_build == 'true'))
     needs: [checks, unit-tests]
     uses: ./.github/workflows/build-artifacts.yml
     with:
@@ -853,10 +864,8 @@ jobs:
     name: Tag tested image as stable
     if: >-
       github.repository == 'nginx/kubernetes-ingress' && (
-      needs.checks.outputs.forked_workflow == 'false' && (
-      (needs.checks.outputs.forked_workflow == 'false' &&
-      needs.checks.outputs.stable_image_exists != 'true'))
-      )
+      needs.checks.outputs.forked_workflow == 'false' &&
+      needs.checks.outputs.stable_image_exists != 'true')
     needs: [checks, build-artifacts, smoke-tests-oss, smoke-tests-plus, smoke-tests-nap]
     permissions:
       contents: read # To checkout repository