ci: report commit status for workflow_run-triggered checks

build-push-agent-bundle.yml, build-push-controller-manager.yml, and e2e.yml
now trigger via workflow_run instead of directly on pull_request, which
means their runs don't automatically surface as a check on the PR that
triggered the upstream workflow - the same gap already solved the same way
in kaapi's helm-upgrade.yml. Each now posts a pending commit status against
the original commit as soon as it starts, and a success/failure status when
it finishes, via a shared .ci/report-commit-status.sh script instead of
inlining the same gh api call three times.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: indradhanush

.ci/report-commit-status.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# report-commit-status.sh - posts a commit status against a given SHA via the GitHub API.
+#
+# workflow_run-triggered jobs don't automatically surface as a check on the PR that triggered
+# the upstream workflow, so downstream workflows call this explicitly (once as "pending" when
+# they start, once as "success"/"failure" when they finish) to report their own status back
+# onto that commit.
+#
+# Usage: report-commit-status.sh <state> <context> <description>
+# Required env: GH_TOKEN, SHA (the commit to report against)
+# Relies on GitHub Actions' own GITHUB_REPOSITORY, GITHUB_SERVER_URL, GITHUB_RUN_ID.
+
+main() {
+  local state=$1
+  local context=$2
+  local description=$3
+
+  gh api "repos/${GITHUB_REPOSITORY}/statuses/${SHA}" \
+    --method POST \
+    -f state="${state}" \
+    -f context="${context}" \
+    -f description="${description}" \
+    -f target_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+}
+
+main "$@"

.github/workflows/build-push-agent-bundle.yml

@@ -17,6 +17,12 @@ jobs:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           fetch-depth: 0
 
+      - name: Report pending commit status
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+        run: bash .ci/report-commit-status.sh pending build-push-agent-bundle "Agent bundle build in progress"
+
       - name: Download agent binary artifact
         if: ${{ github.event_name == 'workflow_run' }}
         uses: actions/download-artifact@v4
@@ -46,3 +52,10 @@ jobs:
         env:
           SKIP_BUILD: ${{ github.event_name == 'workflow_run' && '1' || '' }}
         run: bash .ci/build-push-agent-deb.sh
+
+      - name: Report final commit status
+        if: always()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+        run: bash .ci/report-commit-status.sh "${{ job.status == 'success' && 'success' || 'failure' }}" build-push-agent-bundle "Agent bundle build ${{ job.status }}"

.github/workflows/build-push-controller-manager.yml

@@ -17,6 +17,12 @@ jobs:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           fetch-depth: 0
 
+      - name: Report pending commit status
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+        run: bash .ci/report-commit-status.sh pending build-push-controller-manager "Controller manager build in progress"
+
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
@@ -48,3 +54,10 @@ jobs:
           name: controller-manager-image
           path: controller-manager-image.tar
           retention-days: 1
+
+      - name: Report final commit status
+        if: always()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+        run: bash .ci/report-commit-status.sh "${{ job.status == 'success' && 'success' || 'failure' }}" build-push-controller-manager "Controller manager build ${{ job.status }}"

.github/workflows/e2e.yml

@@ -18,6 +18,12 @@ jobs:
       with:
         ref: ${{ github.event.workflow_run.head_sha || github.sha }}
 
+    - name: Report pending commit status
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+      run: bash .ci/report-commit-status.sh pending e2e-suite "e2e tests in progress"
+
     - name: Download controller manager image artifact
       if: ${{ github.event_name == 'workflow_run' }}
       uses: actions/download-artifact@v4
@@ -51,3 +57,10 @@ jobs:
       env:
         SKIP_BUILD: ${{ github.event_name == 'workflow_run' && '1' || '' }}
       run: yes | GINKGO_NODES=7 make test-e2e
+
+    - name: Report final commit status
+      if: always()
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+      run: bash .ci/report-commit-status.sh "${{ job.status == 'success' && 'success' || 'failure' }}" e2e-suite "e2e tests ${{ job.status }}"