From 99601351a5d0e0507006ac5bc5e6d57cc874cfca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Mon, 26 Oct 2026 09:39:38 +0100
Subject: [PATCH] ci: add gate checks that report on docs-only PRs and name the
 Windows job

---
 .github/workflows/sanitizers.yaml | 43 ++++++++++++++++++++++++++--
 .github/workflows/tests.yaml      | 47 +++++++++++++++++++++++++++++--
 .github/workflows/windows.yaml    |  1 +
 3 files changed, 87 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/sanitizers.yaml b/.github/workflows/sanitizers.yaml
index 0f6e2e2c7c..fa44005ab1 100644
--- a/.github/workflows/sanitizers.yaml
+++ b/.github/workflows/sanitizers.yaml
@@ -7,8 +7,6 @@ on:
   pull_request:
     branches:
       - main
-    paths-ignore:
-      - "docs/**"
   push:
     branches:
       - main
@@ -20,9 +18,32 @@ env:
   GOTOOLCHAIN: local
   GOTESTSUM_FORMAT: pkgname-and-test-fails
 jobs:
+  # Docs-only PRs skip the jobs below instead of the whole workflow, so the required gate check still reports
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - id: filter
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -o pipefail
+          if [ -z "${PR}" ] || gh api --paginate "repos/${REPO}/pulls/${PR}/files" --jq '.[].filename' | grep -qv '^docs/'; then
+            echo "code=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "code=false" >> "${GITHUB_OUTPUT}"
+          fi
   # Adapted from https://github.com/beberlei/hdrhistogram-php
   sanitizers:
     name: ${{ matrix.sanitizer }}
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -108,3 +129,21 @@ jobs:
           } >> "$GITHUB_ENV"
       - name: Run tests
         run: gotestsum -- ${{ matrix.sanitizer == 'msan' && '-tags=nowatcher' || '' }} -${{ matrix.sanitizer }} -timeout ${{ matrix.sanitizer == 'msan' && '60m' || '30m' }} ./...
+  gate:
+    name: Sanitizers passed
+    if: always()
+    needs: [changes, sanitizers]
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          for result in ${RESULTS}; do
+            case "${result}" in
+            success | skipped) ;;
+            *)
+              echo "::error::A required job ended with ${result}"
+              exit 1
+              ;;
+            esac
+          done
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 39f3419362..b187ae4e73 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -7,8 +7,6 @@ on:
   pull_request:
     branches:
       - main
-    paths-ignore:
-      - "docs/**"
   push:
     branches:
       - main
@@ -21,8 +19,31 @@ env:
   GOEXPERIMENT: cgocheck2
   GOTESTSUM_FORMAT: pkgname-and-test-fails
 jobs:
+  # Docs-only PRs skip the jobs below instead of the whole workflow, so the required gate check still reports
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - id: filter
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -o pipefail
+          if [ -z "${PR}" ] || gh api --paginate "repos/${REPO}/pulls/${PR}/files" --jq '.[].filename' | grep -qv '^docs/'; then
+            echo "code=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "code=false" >> "${GITHUB_OUTPUT}"
+          fi
   tests-linux:
     name: Tests (Linux, PHP ${{ matrix.php-versions }})
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     continue-on-error: ${{ matrix.experimental || false }}
     strategy:
@@ -98,6 +119,8 @@ jobs:
         working-directory: caddy/
   integration-tests:
     name: Integration Tests (Linux, PHP ${{ matrix.php-versions }})
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -134,6 +157,8 @@ jobs:
         run: gotestsum -- -tags integration -timeout 30m
   tests-mac:
     name: Tests (macOS, PHP 8.5)
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: macos-latest
     env:
       HOMEBREW_NO_AUTO_UPDATE: 1
@@ -159,3 +184,21 @@ jobs:
       - name: Run Caddy module tests
         working-directory: caddy/
         run: gotestsum -- -race ./...
+  gate:
+    name: Tests passed
+    if: always()
+    needs: [changes, tests-linux, integration-tests, tests-mac]
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          for result in ${RESULTS}; do
+            case "${result}" in
+            success | skipped) ;;
+            *)
+              echo "::error::A required job ended with ${result}"
+              exit 1
+              ;;
+            esac
+          done
diff --git a/.github/workflows/windows.yaml b/.github/workflows/windows.yaml
index 267931b814..3f37f60979 100644
--- a/.github/workflows/windows.yaml
+++ b/.github/workflows/windows.yaml
@@ -39,6 +39,7 @@ env:
 
 jobs:
   build:
+    name: Windows build
     permissions:
       contents: write
       id-token: write