ci: Introduce backend-all-green as a "must-be-green" job

Author: thomass-dev

.github/workflows/backend.yml

@@ -1,14 +1,46 @@
 name: backend
 
-on: [workflow_call]
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  merge_group:
+    types: [checks_requested]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
 
 defaults:
   run:
     shell: "bash"
 
 jobs:
+  backend-changes:
+    runs-on: ubuntu-latest
+    outputs:
+      changes: ${{ steps.filter.outputs.backend }}
+    permissions:
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: filter
+        with:
+          filters: |
+            backend:
+              - '.github/workflows/backend.yml'
+              - 'skore/**'
+
   backend-lint:
     runs-on: "ubuntu-latest"
+    needs: [backend-changes]
+    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name) && needs.backend-changes.outputs.changes == 'true') }}
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -30,7 +62,10 @@ jobs:
 
   backend-lockfiles:
     runs-on: "ubuntu-latest"
-    if: ${{ github.event_name == 'pull_request' }}
+    needs: [backend-changes]
+    if: ${{ (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name) && needs.backend-changes.outputs.changes == 'true') }}
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -50,6 +85,8 @@ jobs:
           fi
 
   backend-test:
+    needs: [backend-changes]
+    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name) && needs.backend-changes.outputs.changes == 'true') }}
     strategy:
       fail-fast: false
       matrix:
@@ -68,6 +105,8 @@ jobs:
             scikit-learn: "1.6"
             coverage: true
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -132,8 +171,7 @@ jobs:
 
       - name: Show dependencies versions
         working-directory: skore/
-        run: |
-          python -c "import skore; skore.show_versions()"
+        run: python -c 'import skore; skore.show_versions()'
 
       - name: Test without coverage
         if: ${{ ! matrix.coverage }}
@@ -155,3 +193,16 @@ jobs:
         with:
           name: backend-coverage
           path: skore/coverage/
+
+  backend-all-green:
+    needs:
+      - backend-changes
+      - backend-lint
+      - backend-lockfiles
+      - backend-test
+    if: ${{ always() }}
+    runs-on: Ubuntu-latest
+    steps:
+      - shell: bash
+        run: |
+          [[  ${{ contains(needs.*.result, 'failure') }} = false ]]

.github/workflows/ci.yml

@@ -1,6 +1,19 @@
 name: lint
 
-on: [workflow_call]
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  merge_group:
+    types: [checks_requested]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
 
 defaults:
   run: