ci: Introduce backend-all-green as a "must-be-green" job

Author: thomass-dev

.github/workflows/backend.yml

@@ -1,20 +1,55 @@
 name: backend
 
-on: [workflow_call]
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  merge_group:
+    types: [checks_requested]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
 
 defaults:
   run:
     shell: "bash"
 
 jobs:
+  backend-changes:
+    runs-on: ubuntu-latest
+    outputs:
+      changes: ${{ steps.filter.outputs.backend }}
+    permissions:
+      pull-requests: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Define if at least one file has changed
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: filter
+        with:
+          filters: |
+            backend:
+              - '.github/workflows/backend.yml'
+              - 'skore/**'
+
   backend-lint:
     runs-on: "ubuntu-latest"
+    needs: [backend-changes]
+    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name) && needs.backend-changes.outputs.changes == 'true') }}
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
         with:
           python-version: "3.12"
           cache: pip
@@ -30,10 +65,13 @@ jobs:
 
   backend-lockfiles:
     runs-on: "ubuntu-latest"
-    if: ${{ github.event_name == 'pull_request' }}
+    needs: [backend-changes]
+    if: ${{ (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name) && needs.backend-changes.outputs.changes == 'true') }}
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 2
 
@@ -50,6 +88,8 @@ jobs:
           fi
 
   backend-test:
+    needs: [backend-changes]
+    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || (contains(fromJSON('["pull_request", "merge_group"]'), github.event_name) && needs.backend-changes.outputs.changes == 'true') }}
     strategy:
       fail-fast: false
       matrix:
@@ -68,20 +108,22 @@ jobs:
             scikit-learn: "1.6"
             coverage: true
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
         id: setup-python
         with:
           python-version: ${{ matrix.python }}
           check-latest: True
           cache: pip
 
       - name: Restore python-venv
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         id: cache-python-venv
         with:
           path: 'skore/venv'
@@ -116,7 +158,7 @@ jobs:
           python -m pip install --requirement test-requirements.txt
 
       - name: Save python-venv
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         if: steps.cache-python-venv.outputs.cache-hit != 'true'
         with:
           path: 'skore/venv'
@@ -132,8 +174,7 @@ jobs:
 
       - name: Show dependencies versions
         working-directory: skore/
-        run: |
-          python -c "import skore; skore.show_versions()"
+        run: python -c 'import skore; skore.show_versions()'
 
       - name: Test without coverage
         if: ${{ ! matrix.coverage }}
@@ -151,7 +192,20 @@ jobs:
 
       - name: Upload coverage reports
         if: ${{ matrix.coverage && (github.event_name == 'pull_request') }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: backend-coverage
           path: skore/coverage/
+
+  backend-all-green:
+    needs:
+      - backend-changes
+      - backend-lint
+      - backend-lockfiles
+      - backend-test
+    if: ${{ always() }}
+    runs-on: Ubuntu-latest
+    steps:
+      - shell: bash
+        run: |
+          [[  ${{ contains(needs.*.result, 'failure') }} = false ]]

.github/workflows/ci.yml

@@ -1,6 +1,19 @@
 name: lint
 
-on: [workflow_call]
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  merge_group:
+    types: [checks_requested]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
 
 defaults:
   run: