fix(ci): three CI workflow optimizations

.github/labeler.yml

@@ -1,14 +1,13 @@
 # Add 'documentation' label to any change to *.md files
 documentation:
   - changed-files:
-      - any-glob-to-any-file: [ '**/*.md' ]
+      - any-glob-to-any-file: ["**/*.md"]
 
 # Add 'github_actions' label to any change .github/ directory
 github_actions:
   - changed-files:
-      - any-glob-to-any-file: [ '.github/**' ]
-
+      - any-glob-to-any-file: [".github/**"]
 
 osc:
   - changed-files:
-      - any-glob-to-any-file: [ '**' ]
+      - any-glob-to-any-file: ["**"]

.github/workflows/pr-build-java.yml

@@ -1,17 +1,37 @@
 name: Pull Request Build - Java
 
+# This workflow has no `on.pull_request.paths` filter on purpose. A workflow
+# skipped by path filtering reports no check run at all, which leaves a required
+# status check pending forever. Gating happens in the `changes` job instead, and
+# `pr-build-java-complete` always reports.
 on:
   pull_request:
-    paths:
-      - 'java/**'
-      - 'opentelemetry-lambda/**'
-      - '.github/workflows/*-java.yml'
-      - '.github/workflows/tests.yml'
-      - '!java/sample-apps/template.yaml'
-      - '!**/*.md'
 
 jobs:
+  changes:
+    runs-on: ubuntu-22.04
+    outputs:
+      any_changed: ${{ steps.changed-files.outputs.any_changed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check if Java related files changed
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.6
+        with:
+          files: |
+            java/**
+            opentelemetry-lambda/**
+            .github/workflows/*-java.yml
+            .github/workflows/tests.yml
+          files_ignore: |
+            java/sample-apps/template.yaml
+            **/*.md
+
   build-artifacts:
+    needs: changes
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/build-artifacts.yml
     with:
       BUILD_COMMAND: make build-java
@@ -20,17 +40,30 @@ jobs:
       ARTIFACT_NAME: ${{ github.run_id }}
 
   create-dev-lambda-layer:
-    needs: build-artifacts
+    needs: [changes, build-artifacts]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/publish-dev-layer.yml
     with:
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-java-wrapper
       ARTIFACT_NAME: ${{ github.run_id }}
       LANGUAGE: java
 
   run-tests:
-    needs: create-dev-lambda-layer
+    needs: [changes, create-dev-lambda-layer]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/tests.yml
     with:
       LANGUAGE: java
       LAYER_ARN_AMD64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayeramd64 }}
       LAYER_ARN_ARM64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayerarm64 }}
+
+  pr-build-java-complete:
+    runs-on: ubuntu-22.04
+    needs: [changes, build-artifacts, create-dev-lambda-layer, run-tests]
+    if: always()
+    steps:
+      - name: Fail if any job did not pass
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "At least one Java build job failed or was cancelled."
+          exit 1

.github/workflows/pr-build-nodejs.yml

@@ -1,17 +1,37 @@
 name: Pull Request Build - NodeJS
 
+# This workflow has no `on.pull_request.paths` filter on purpose. A workflow
+# skipped by path filtering reports no check run at all, which leaves a required
+# status check pending forever. Gating happens in the `changes` job instead, and
+# `pr-build-nodejs-complete` always reports.
 on:
   pull_request:
-    paths:
-      - 'nodejs/**'
-      - 'opentelemetry-lambda/**'
-      - '.github/workflows/*-nodejs.yml'
-      - '.github/workflows/tests.yml'
-      - '!nodejs/sample-apps/template.yaml'
-      - '!**/*.md'
 
 jobs:
+  changes:
+    runs-on: ubuntu-22.04
+    outputs:
+      any_changed: ${{ steps.changed-files.outputs.any_changed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check if NodeJS related files changed
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.6
+        with:
+          files: |
+            nodejs/**
+            opentelemetry-lambda/**
+            .github/workflows/*-nodejs.yml
+            .github/workflows/tests.yml
+          files_ignore: |
+            nodejs/sample-apps/template.yaml
+            **/*.md
+
   build-artifacts:
+    needs: changes
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/build-artifacts.yml
     with:
       BUILD_COMMAND: make build-nodejs
@@ -20,17 +40,30 @@ jobs:
       ARTIFACT_NAME: ${{ github.run_id }}
 
   create-dev-lambda-layer:
-    needs: build-artifacts
+    needs: [changes, build-artifacts]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/publish-dev-layer.yml
     with:
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-nodejs
       ARTIFACT_NAME: ${{ github.run_id }}
       LANGUAGE: nodejs
 
   run-tests:
-    needs: create-dev-lambda-layer
+    needs: [changes, create-dev-lambda-layer]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/tests.yml
     with:
       LANGUAGE: nodejs
       LAYER_ARN_AMD64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayeramd64 }}
       LAYER_ARN_ARM64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayerarm64 }}
+
+  pr-build-nodejs-complete:
+    runs-on: ubuntu-22.04
+    needs: [changes, build-artifacts, create-dev-lambda-layer, run-tests]
+    if: always()
+    steps:
+      - name: Fail if any job did not pass
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "At least one NodeJS build job failed or was cancelled."
+          exit 1

.github/workflows/pr-build-python.yml

@@ -1,17 +1,37 @@
 name: Pull Request Build - Python
 
+# This workflow has no `on.pull_request.paths` filter on purpose. A workflow
+# skipped by path filtering reports no check run at all, which leaves a required
+# status check pending forever. Gating happens in the `changes` job instead, and
+# `pr-build-python-complete` always reports.
 on:
   pull_request:
-    paths:
-      - 'python/**'
-      - 'opentelemetry-lambda/**'
-      - '.github/workflows/*-python.yml'
-      - '.github/workflows/tests.yml'
-      - '!python/sample-apps/template.yaml'
-      - '!**/*.md'
 
 jobs:
+  changes:
+    runs-on: ubuntu-22.04
+    outputs:
+      any_changed: ${{ steps.changed-files.outputs.any_changed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check if Python related files changed
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.6
+        with:
+          files: |
+            python/**
+            opentelemetry-lambda/**
+            .github/workflows/*-python.yml
+            .github/workflows/tests.yml
+          files_ignore: |
+            python/sample-apps/template.yaml
+            **/*.md
+
   build-artifacts:
+    needs: changes
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/build-artifacts.yml
     with:
       BUILD_COMMAND: make build-python
@@ -20,17 +40,30 @@ jobs:
       ARTIFACT_NAME: ${{ github.run_id }}
 
   create-dev-lambda-layer:
-    needs: build-artifacts
+    needs: [changes, build-artifacts]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/publish-dev-layer.yml
     with:
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-python
       ARTIFACT_NAME: ${{ github.run_id }}
       LANGUAGE: python
 
   run-tests:
-    needs: create-dev-lambda-layer
+    needs: [changes, create-dev-lambda-layer]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/tests.yml
     with:
       LANGUAGE: python
       LAYER_ARN_AMD64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayeramd64 }}
       LAYER_ARN_ARM64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayerarm64 }}
+
+  pr-build-python-complete:
+    runs-on: ubuntu-22.04
+    needs: [changes, build-artifacts, create-dev-lambda-layer, run-tests]
+    if: always()
+    steps:
+      - name: Fail if any job did not pass
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "At least one Python build job failed or was cancelled."
+          exit 1

.github/workflows/publish-release-layer.yml

@@ -25,7 +25,7 @@ jobs:
         architecture: [ amd64, arm64 ]
         aws_region: [ us-east-1, us-east-2, us-west-1, us-west-2, af-south-1, ap-east-1, ap-south-1, ap-northeast-3,
                       ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1,
-                      eu-west-1, eu-west-2, eu-south-1, eu-west-3, eu-north-1, sa-east-1 ] # me-south-1 temporarily disabled
+                      eu-west-1, eu-west-2, eu-south-1, eu-west-3, eu-north-1, sa-east-1 ]  # me-south-1 temporarily disabled
         exclude:
           - aws_region: ap-northeast-2
             architecture: arm64

.github/workflows/pull-request-checks.yml

@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
       - name: Check if documentation related files changed
         id: changed-files
-        uses: tj-actions/changed-files@v44
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.6
         with:
           files: |
             **/*.md
@@ -31,30 +31,29 @@ jobs:
   markdownlint:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: install markdownlint
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: npm install -g markdownlint-cli
       - name: markdownlint check
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: make markdown-lint
 
   yamllint:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: install yamllint
-        if: needs.chart-changed.outputs.any_changed == 'true'
         run: pip install yamllint
       - name: yamllint
-        if: needs.chart-changed.outputs.any_changed == 'true'
         run: make yaml-lint
 
   markdown-link-check:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - uses: gaurav-nelson/github-action-markdown-link-check@v1
@@ -67,24 +66,23 @@ jobs:
   md-links-lint:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: Lint markdown links
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: |
           make markdown-links-lint
+
   markdown-table-formatter-check:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
-        if: needs.docs-changed.outputs.any_changed == 'true'
       - name: Install markdown-table-formatter
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: npm install markdown-table-formatter --save
       - name: Run markdown-table-formatter
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: CMD=./node_modules/.bin/markdown-table-formatter make markdown-table-formatter-check
 
   terraform-lint:
@@ -113,3 +111,24 @@ jobs:
         uses: dflook/terraform-fmt@v1
         with:
           path: utils/receiver-mock/deploy
+
+  # Single required status check for this workflow. A job skipped by a job-level
+  # `if` reports a `skipped` conclusion that branch protection accepts, so this
+  # stays green when no relevant files changed but fails if any check failed.
+  pr-checks-complete:
+    runs-on: ubuntu-22.04
+    needs:
+      - docs-changed
+      - markdownlint
+      - yamllint
+      - markdown-link-check
+      - md-links-lint
+      - markdown-table-formatter-check
+      - terraform-lint
+    if: always()
+    steps:
+      - name: Fail if any check did not pass
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "At least one PR check failed or was cancelled."
+          exit 1

.github/workflows/release-build-java.yml

@@ -126,10 +126,8 @@ jobs:
             ${{ env.ARM64_LAYERS }}
 
             ## Lambda Container dependencies:
-
             - [amd64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-java-wrapper-amd64.zip)
             - [arm64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-java-wrapper-arm64.zip)
-
           artifacts: "artifacts/opentelemetry-java-wrapper-amd64.zip,artifacts/opentelemetry-java-wrapper-arm64.zip,artifacts/java-sample-app.jar"
           artifactErrorsFailBuild: true
           replacesArtifacts: true

.github/workflows/release-build-nodejs.yml

@@ -126,7 +126,6 @@ jobs:
             ${{ env.ARM64_LAYERS }}
 
             ## Lambda Container dependencies:
-
             - [amd64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-nodejs-amd64.zip)
             - [arm64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-nodejs-arm64.zip)
 

.github/workflows/release-build-python.yml

@@ -126,7 +126,6 @@ jobs:
             ${{ env.ARM64_LAYERS }}
 
             ## Lambda Container dependencies:
-
             - [amd64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-python-amd64.zip)
             - [arm64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-python-arm64.zip)