ci: Gate manual release workflows on wait-for-checks (#1913)

Here it is - finally, an attempt to adopt `wait-for-checks` action.

I started by consolidating all the checks into a single workflow. I
think that makes sense: the boundaries between them weren't very well
defined, and there's no real need to distinguish them.

Now `wait-for-checks` is in place, with `Check*` as the only regex
specifying the checks to wait for.

Let me know what you think @janbuchar.

Author: vdusek

.github/workflows/_check_code.yaml

@@ -0,0 +1,104 @@
+name: Checks
+
+on:
+  # Runs when manually triggered from the GitHub UI.
+  workflow_dispatch:
+    inputs:
+      run_tests:
+        description: Whether to run the unit test suite.
+        required: false
+        type: boolean
+        default: true
+
+  # Runs when invoked by another workflow.
+  workflow_call:
+    inputs:
+      run_tests:
+        description: Whether to run the unit test suite.
+        required: false
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  actions_lint_check:
+    name: Actions lint check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Run actionlint
+        uses: rhysd/actionlint@v1.7.12
+
+  spell_check:
+    name: Spell check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Check spelling with typos
+        uses: crate-ci/typos@v1
+
+  lint_check:
+    name: Lint check
+    uses: apify/workflows/.github/workflows/python_lint_check.yaml@main
+    with:
+      python_versions: '["3.10", "3.11", "3.12", "3.13", "3.14"]'
+
+  type_check:
+    name: Type check
+    uses: apify/workflows/.github/workflows/python_type_check.yaml@main
+    with:
+      python_versions: '["3.10", "3.11", "3.12", "3.13", "3.14"]'
+
+  unit_tests:
+    name: Unit tests
+    if: inputs.run_tests
+    uses: apify/workflows/.github/workflows/python_unit_tests.yaml@main
+    secrets: inherit
+    with:
+      python_versions: '["3.10", "3.11", "3.12", "3.13", "3.14"]'
+      operating_systems: '["ubuntu-latest", "windows-latest", "macos-latest"]'
+      python_version_for_codecov: "3.14"
+      operating_system_for_codecov: ubuntu-latest
+      tests_concurrency: "8"
+
+  package_check:
+    name: Package check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up uv package manager
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          python-version: "3.14"
+
+      - name: Build sdist and wheel
+        run: uv run poe build
+
+      - name: Verify built package
+        uses: apify/actions/python-package-check@v1.1.0
+        with:
+          package_name: crawlee
+          dist_dir: dist
+          python_version: "3.14"
+          extras: all
+          smoke_code: |
+            from crawlee.crawlers import (
+                HttpCrawler, BeautifulSoupCrawler, ParselCrawler,
+                PlaywrightCrawler, AdaptivePlaywrightCrawler,
+            )
+            from crawlee.storages import Dataset, KeyValueStore, RequestQueue
+            from crawlee.http_clients import HttpxHttpClient, ImpitHttpClient
+            from crawlee import Request
+            HttpCrawler()
+            BeautifulSoupCrawler()
+            ParselCrawler()
+
+  doc_check:
+    name: Doc check
+    uses: apify/workflows/.github/workflows/python_docs_check.yaml@main

.github/workflows/_check_docs.yaml

@@ -16,8 +16,22 @@ permissions:
   contents: read
 
 jobs:
+  wait_for_checks:
+    # Gate the release on the `Checks` workflow already succeeding on this commit (run by `on_master.yaml`).
+    name: Wait for required checks
+    runs-on: ubuntu-latest
+    permissions:
+      checks: read
+    steps:
+      - name: Wait for checks
+        uses: apify/actions/wait-for-checks@v1.2.0
+        with:
+          ref: ${{ github.sha }}
+          check-regexp: '^Checks'
+
   release_prepare:
     name: Release prepare
+    needs: [wait_for_checks]
     runs-on: ubuntu-latest
     outputs:
       version_number: ${{ steps.release_prepare.outputs.version_number }}

.github/workflows/_check_package.yaml

@@ -23,9 +23,19 @@ jobs:
       contents: write
       pages: write
       id-token: write
+      checks: read
     runs-on: ubuntu-latest
 
     steps:
+      # Gate manual dispatches on the `Checks` workflow already succeeding on this commit (run by `on_master.yaml`);
+      # skipped when called from another workflow. TODO: pin to a tag after apify/workflows#238 is merged.
+      - name: Wait for checks
+        if: github.event_name == 'workflow_dispatch'
+        uses: apify/workflows/wait-for-checks@wait-for-checks-action
+        with:
+          ref: ${{ github.sha }}
+          check-regexp: '^Checks'
+
       - name: Checkout repository
         uses: actions/checkout@v6
         with:

.github/workflows/_checks.yaml

@@ -29,13 +29,22 @@ permissions:
   contents: read
 
 jobs:
-  code_checks:
-    name: Code checks
-    uses: ./.github/workflows/_check_code.yaml
+  wait_for_checks:
+    # Gate the release on the `Checks` workflow already succeeding on this commit (run by `on_master.yaml`).
+    name: Wait for required checks
+    runs-on: ubuntu-latest
+    permissions:
+      checks: read
+    steps:
+      - name: Wait for checks
+        uses: apify/actions/wait-for-checks@v1.2.0
+        with:
+          ref: ${{ github.sha }}
+          check-regexp: '^Checks'
 
   release_prepare:
     name: Release prepare
-    needs: [code_checks]
+    needs: [wait_for_checks]
     runs-on: ubuntu-latest
     outputs:
       version_number: ${{ steps.release_prepare.outputs.version_number }}

.github/workflows/_tests.yaml

@@ -36,8 +36,18 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      checks: read
 
     steps:
+      # Gate manual dispatches on the `Checks` workflow already succeeding on this commit (run by `on_master.yaml`);
+      # skipped when called from another workflow.
+      - name: Wait for checks
+        if: github.event_name == 'workflow_dispatch'
+        uses: apify/actions/wait-for-checks@v1.2.0
+        with:
+          ref: ${{ github.sha }}
+          check-regexp: '^Checks'
+
       - name: Checkout repository
         uses: actions/checkout@v6
         with:

.github/workflows/manual_release_beta.yaml

@@ -11,33 +11,26 @@ permissions:
   contents: read
 
 jobs:
-  doc_checks:
-    name: Doc checks
-    uses: ./.github/workflows/_check_docs.yaml
+  checks:
+    name: Checks
+    uses: ./.github/workflows/_checks.yaml
+    with:
+      # Skip the test suite for docs-only commits — they don't change runtime behavior.
+      run_tests: ${{ !startsWith(github.event.head_commit.message, 'docs') }}
+    secrets: inherit
 
   doc_release:
     # Skip this for non-"docs" commits.
     if: startsWith(github.event.head_commit.message, 'docs')
     name: Doc release
-    needs: [doc_checks]
+    needs: [checks]
     permissions:
       contents: write
       pages: write
       id-token: write
     uses: ./.github/workflows/manual_release_docs.yaml
     secrets: inherit
 
-  code_checks:
-    name: Code checks
-    uses: ./.github/workflows/_check_code.yaml
-
-  tests:
-    # Skip this for "docs" commits.
-    if: "!startsWith(github.event.head_commit.message, 'docs')"
-    name: Tests
-    uses: ./.github/workflows/_tests.yaml
-    secrets: inherit
-
   # The beta release is dispatched as a separate workflow run (instead of calling `manual_release_beta.yaml` via `uses:`)
   # because PyPI's Trusted Publishing does not currently support reusable workflows.
   # See: https://docs.pypi.org/trusted-publishers/troubleshooting/#reusable-workflows-on-github
@@ -50,7 +43,7 @@ jobs:
       startsWith(github.event.head_commit.message, 'refactor') ||
       startsWith(github.event.head_commit.message, 'style')
     name: Beta release
-    needs: [code_checks, tests]
+    needs: [checks]
     runs-on: ubuntu-latest
     permissions:
       actions: write # Required by execute-workflow.