ci: use native path filters and verify fully after merge

.github/workflows/_build.yml

@@ -1,9 +1,14 @@
 name: build
 on:
   workflow_call:
+    inputs:
+      docker:
+        type: boolean
+        default: true
 
 jobs:
   build-server-docker:
+    if: inputs.docker
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7

.github/workflows/_test.yml

@@ -1,9 +1,14 @@
 name: test
 on:
   workflow_call:
+    inputs:
+      webapp_only:
+        type: boolean
+        default: false
 
 jobs:
   test-discojs:
+    if: ${{ !inputs.webapp_only }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -14,6 +19,7 @@ jobs:
       - run: pnpm exec vitest --run --project=discojs
 
   test-discojs-node:
+    if: ${{ !inputs.webapp_only }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -24,6 +30,7 @@ jobs:
       - run: pnpm exec vitest --run --project=discojs-node
 
   test-discojs-web:
+    if: ${{ !inputs.webapp_only }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -34,6 +41,7 @@ jobs:
       - run: pnpm exec vitest --run --project=discojs-web
 
   test-server:
+    if: ${{ !inputs.webapp_only }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -175,6 +183,7 @@ jobs:
           if-no-files-found: ignore
 
   test-cli:
+    if: ${{ !inputs.webapp_only }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -202,6 +211,7 @@ jobs:
           pnpm -F cli start -t cifar10 -u 3 -e 1 -r 1 -i ci-cifar10
 
   test-docs-examples:
+    if: ${{ !inputs.webapp_only }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7

.github/workflows/publish-deploy.yml

@@ -1,17 +1,23 @@
 name: publish-deploy
 on:
-  push:
+  workflow_run:
+    workflows: ["verify"]
     branches: [main]
+    types: [completed]
+  push:
     tags: [v*]
 
 jobs:
   publish-npm:
+    if: github.event_name == 'push' || (github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.ref }}
       - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
@@ -26,12 +32,14 @@ jobs:
       - run: pnpm -F 'discojs*' publish --access public --tag latest
 
   build-webapp:
-    if: github.ref_type == 'branch'
+    if: github.event_name == 'workflow_run' && github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
       - uses: ./.github/actions/setup-node
       - run: pnpm -F webapp run build
       - uses: actions/upload-pages-artifact@v5
@@ -53,13 +61,17 @@ jobs:
         uses: actions/deploy-pages@v5
 
   publish-github-container:
+    if: github.event_name == 'push' || (github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.ref }}
       - uses: docker/login-action@v4
         with:
           registry: ghcr.io
@@ -75,6 +87,7 @@ jobs:
       - uses: docker/build-push-action@v7
         id: build
         with:
+          context: .
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -88,6 +101,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
       - uses: google-github-actions/auth@v3
         with:
           project_id: disco-367212

.github/workflows/verify-webapp.yml

@@ -0,0 +1,30 @@
+name: verify-webapp
+on:
+  pull_request:
+    paths:
+      - "webapp/**"
+
+permissions:
+  contents: read
+
+jobs:
+  download-datasets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/download-datasets
+
+  static-analysis:
+    uses: ./.github/workflows/_static-analysis.yml
+
+  build:
+    needs: [download-datasets, static-analysis]
+    uses: ./.github/workflows/_build.yml
+    with:
+      docker: false
+
+  test:
+    needs: [build]
+    uses: ./.github/workflows/_test.yml
+    with:
+      webapp_only: true

.github/workflows/verify.yml

@@ -2,11 +2,10 @@ name: verify
 on:
   push:
     branches: [main]
-    paths-ignore:
-      - "**/*.md"
   pull_request:
     paths-ignore:
       - "**/*.md"
+      - "webapp/**"
 
 permissions:
   contents: read
@@ -28,3 +27,20 @@ jobs:
   test:
     needs: [build]
     uses: ./.github/workflows/_test.yml
+
+  complete:
+    if: always()
+    needs: [download-datasets, static-analysis, build, test]
+    runs-on: ubuntu-latest
+    env:
+      DATASETS: ${{ needs.download-datasets.result }}
+      STATIC: ${{ needs.static-analysis.result }}
+      BUILD: ${{ needs.build.result }}
+      TEST: ${{ needs.test.result }}
+    steps:
+      - name: Check verification results
+        run: |
+          test "$DATASETS" = success
+          test "$STATIC" = success
+          test "$BUILD" = success
+          test "$TEST" = success