ci: Gate manual release workflows on wait-for-checks

Replace the in-release rerun of checks with a wait-for-checks step that
verifies the `Checks` workflow already passed on the dispatch commit (it
runs via on_master.yaml on every push). Saves the redundant rerun on the
stable release; adds gates to the beta release and the docs workflows that
previously had none. Pinned to the apify/workflows PR branch — switch to a
tagged release once apify/workflows#238 is merged.

Author: vdusek

.github/workflows/manual_release_beta.yaml

@@ -16,8 +16,23 @@ permissions:
   contents: read
 
 jobs:
+  wait_for_checks:
+    # Gate the release on the `Checks` workflow already succeeding on this commit (run by `on_master.yaml`).
+    # TODO: pin to a tag after apify/workflows#238 is merged.
+    name: Wait for required checks
+    runs-on: ubuntu-latest
+    permissions:
+      checks: read
+    steps:
+      - name: Wait for checks
+        uses: apify/workflows/wait-for-checks@wait-for-checks-action
+        with:
+          ref: ${{ github.sha }}
+          check-regexp: '^Checks'
+
   release_prepare:
     name: Release prepare
+    needs: [wait_for_checks]
     runs-on: ubuntu-latest
     outputs:
       version_number: ${{ steps.release_prepare.outputs.version_number }}

.github/workflows/manual_release_docs.yaml

@@ -23,9 +23,19 @@ jobs:
       contents: write
       pages: write
       id-token: write
+      checks: read
     runs-on: ubuntu-latest
 
     steps:
+      # Gate manual dispatches on the `Checks` workflow already succeeding on this commit (run by `on_master.yaml`);
+      # skipped when called from another workflow. TODO: pin to a tag after apify/workflows#238 is merged.
+      - name: Wait for checks
+        if: github.event_name == 'workflow_dispatch'
+        uses: apify/workflows/wait-for-checks@wait-for-checks-action
+        with:
+          ref: ${{ github.sha }}
+          check-regexp: '^Checks'
+
       - name: Checkout repository
         uses: actions/checkout@v6
         with:

.github/workflows/manual_release_stable.yaml

@@ -29,13 +29,23 @@ permissions:
   contents: read
 
 jobs:
-  code_checks:
-    name: Code checks
-    uses: ./.github/workflows/_check_code.yaml
+  wait_for_checks:
+    # Gate the release on the `Checks` workflow already succeeding on this commit (run by `on_master.yaml`).
+    # TODO: pin to a tag after apify/workflows#238 is merged.
+    name: Wait for required checks
+    runs-on: ubuntu-latest
+    permissions:
+      checks: read
+    steps:
+      - name: Wait for checks
+        uses: apify/workflows/wait-for-checks@wait-for-checks-action
+        with:
+          ref: ${{ github.sha }}
+          check-regexp: '^Checks'
 
   release_prepare:
     name: Release prepare
-    needs: [code_checks]
+    needs: [wait_for_checks]
     runs-on: ubuntu-latest
     outputs:
       version_number: ${{ steps.release_prepare.outputs.version_number }}

.github/workflows/manual_version_docs.yaml

@@ -36,8 +36,18 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      checks: read
 
     steps:
+      # Gate manual dispatches on the `Checks` workflow already succeeding on this commit (run by `on_master.yaml`);
+      # skipped when called from another workflow. TODO: pin to a tag after apify/workflows#238 is merged.
+      - name: Wait for checks
+        if: github.event_name == 'workflow_dispatch'
+        uses: apify/workflows/wait-for-checks@wait-for-checks-action
+        with:
+          ref: ${{ github.sha }}
+          check-regexp: '^Checks'
+
       - name: Checkout repository
         uses: actions/checkout@v6
         with: