chore: prevent CI double runs on push + pull_request (#26766)

.github/workflows/check_db_migration_confict.yml

@@ -3,6 +3,12 @@ on:
   push:
     paths:
       - "superset/migrations/**"
+    branches:
+      - 'master'
+  pull_request:
+    paths:
+      - "superset/migrations/**"
+    types: [synchronize, opened, reopened, ready_for_review]
 
 jobs:
   check_db_migration_conflict:

.github/workflows/docker.yml

@@ -33,6 +33,13 @@ jobs:
       matrix:
         target: ["dev", "lean", "lean310", "websocket", "dockerize"]
         platform: ["linux/amd64", "linux/arm64"]
+        exclude:
+          # disabling because slow! no python wheels for arm/py39 and
+          # QEMU is slow!
+          - target: "dev"
+            platform: "linux/arm64"
+          - target: "lean"
+            platform: "linux/arm64"
       fail-fast: false
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"

.github/workflows/license-check.yml

@@ -2,9 +2,10 @@ name: License Check
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/**"
+      - 'master'
   pull_request:
+    types: [synchronize, opened, reopened, ready_for_review]
 
 jobs:
   config:

.github/workflows/no-op.yml

@@ -0,0 +1,54 @@
+# no-op.yml
+#
+# Purpose:
+# This workflow provides a workaround for the "required status checks" feature in GitHub Actions
+# when using path-specific conditions in other workflows. Required checks might remain in a "Pending"
+# state if the conditions are not met, thus blocking pull requests from being merged.
+# This no-op (no operation) workflow provides dummy success statuses for these required jobs when
+# the real jobs do not run due to path-specific conditions.
+#
+# How it works:
+# - It defines jobs with the same names as the required jobs in the main workflows.
+# - These jobs simply execute a command (`exit 0`) to succeed immediately.
+# - When a pull request is created or updated, both this no-op workflow and the main workflows are triggered.
+# - If the main workflows' jobs don't run (due to path conditions), these no-op jobs provide successful statuses.
+# - If the main workflows' jobs do run and fail, their failure statuses take precedence,
+#   ensuring that pull requests are not merged with failing checks.
+#
+# Usage:
+# - Ensure that the job names in this workflow match exactly the names of the corresponding jobs in the main workflows.
+# - This workflow should be kept as-is, without path-specific conditions.
+
+name: No Operation Checks
+on: pull_request
+
+jobs:
+  frontend-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: No-op for frontend-build
+        run: |
+          echo "This is a no-op step for frontend-build to ensure a successful status."
+          exit 0
+
+  pre-commit:
+    strategy:
+      matrix:
+        python-version: ["3.9"]
+    runs-on: ubuntu-latest
+    steps:
+      - name: No-op for pre-commit
+        run: |
+          echo "This is a no-op step for pre-commit to ensure a successful status."
+          exit 0
+
+  python-lint:
+    strategy:
+      matrix:
+        python-version: ["3.9"]
+    runs-on: ubuntu-latest
+    steps:
+      - name: No-op for python-lint
+        run: |
+          echo "This is a no-op step for python-lint to ensure a successful status."
+          exit 0

.github/workflows/prefer-typescript.yml

@@ -2,10 +2,14 @@ name: Prefer TypeScript
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/**"
+      - 'master'
+    paths:
+      - "superset-frontend/src/**"
   pull_request:
-
+    types: [synchronize, opened, reopened, ready_for_review]
+    paths:
+      - "superset-frontend/src/**"
 jobs:
   prefer_typescript:
     if: github.ref == 'ref/heads/master' && github.event_name == 'pull_request'

.github/workflows/superset-cli.yml

@@ -2,8 +2,8 @@ name: Superset CLI tests
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/npm_and_yarn/**"
+      - 'master'
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
 

.github/workflows/superset-docs.yml

@@ -4,9 +4,12 @@ on:
   push:
     paths:
       - "docs/**"
+    branches:
+      - 'master'
   pull_request:
     paths:
       - "docs/**"
+    types: [synchronize, opened, reopened, ready_for_review]
 
 jobs:
   config:

.github/workflows/superset-e2e.yml

@@ -2,10 +2,8 @@ name: E2E
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/**/docs/**"
+      - 'master'
-    paths-ignore:
-      - "docs/**"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
 

.github/workflows/superset-frontend.yml

@@ -2,11 +2,14 @@ name: Frontend
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/**/docs/**"
+      - "master"
-      - "dependabot/**/cypress-base/**"
+    paths:
+      - "superset-frontend/**"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
+    paths:
+      - "superset-frontend/**"
 
 jobs:
   frontend-build:

.github/workflows/superset-helm-lint.yml

@@ -3,6 +3,8 @@ name: Lint and Test Charts
 on:
   pull_request:
     types: [opened, edited, reopened, synchronize]
+    paths:
+      - "helm/**"
 
 jobs:
   lint-test:

.github/workflows/superset-python-integrationtest.yml

@@ -3,8 +3,8 @@ name: Python-Integration
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/npm_and_yarn/**"
+      - 'master'
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
 

.github/workflows/superset-python-misc.yml

@@ -3,10 +3,14 @@ name: Python Misc
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/npm_and_yarn/**"
+      - 'master'
+    paths:
+      - "superset/**"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
+    paths:
+      - "superset/**"
 
 jobs:
   python-lint:

.github/workflows/superset-python-presto-hive.yml

@@ -3,10 +3,14 @@ name: Python Presto/Hive
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/npm_and_yarn/**"
+      - 'master'
+    paths:
+      - "superset/**"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
+    paths:
+      - "superset/**"
 
 jobs:
   test-postgres-presto:

.github/workflows/superset-python-unittest.yml

@@ -3,10 +3,14 @@ name: Python-Unit
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/npm_and_yarn/**"
+      - 'master'
+    paths:
+      - "superset/**"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
+    paths:
+      - "superset/**"
 
 jobs:
   unit-tests:

.github/workflows/superset-translations.yml

@@ -2,8 +2,8 @@ name: Translations
 
 on:
   push:
-    branches-ignore:
+    branches:
-      - "dependabot/npm_and_yarn/**"
+      - 'master'
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
 

.github/workflows/superset-websocket.yml

@@ -1,11 +1,14 @@
 name: WebSocket server
 on:
   push:
+    branches:
+      - 'master'
     paths:
       - "superset-websocket/**"
   pull_request:
     paths:
       - "superset-websocket/**"
+    types: [synchronize, opened, reopened, ready_for_review]
 
 jobs:
   app-checks:

scripts/docker_build_push.sh

@@ -70,27 +70,31 @@ fi
 
 BUILD_ARG="3.9-slim-bookworm"
 
+# Replace '/' with '-' in BUILD_PLATFORM
+SAFE_BUILD_PLATFORM=$(echo "${BUILD_PLATFORM}" | sed 's/\//-/g')
+MAIN_UNIQUE_TAG="${REPO_NAME}:${SHA}-${TARGET}-${SAFE_BUILD_PLATFORM}-${BUILD_ARG}"
+
 case "${TARGET}" in
   "dev")
-    DOCKER_TAGS="-t ${REPO_NAME}:${SHA}-dev -t ${REPO_NAME}:${REFSPEC}-dev -t ${DEV_TAG}"
+    DOCKER_TAGS="-t ${MAIN_UNIQUE_TAG} -t ${REPO_NAME}:${SHA}-dev -t ${REPO_NAME}:${REFSPEC}-dev -t ${DEV_TAG}"
     BUILD_TARGET="dev"
     ;;
   "lean")
-    DOCKER_TAGS="-t ${REPO_NAME}:${SHA} -t ${REPO_NAME}:${REFSPEC} -t ${REPO_NAME}:${LATEST_TAG}"
+    DOCKER_TAGS="-t ${MAIN_UNIQUE_TAG} -t ${REPO_NAME}:${SHA} -t ${REPO_NAME}:${REFSPEC} -t ${REPO_NAME}:${LATEST_TAG}"
     BUILD_TARGET="lean"
     ;;
   "lean310")
-    DOCKER_TAGS="-t ${REPO_NAME}:${SHA}-py310 -t ${REPO_NAME}:${REFSPEC}-py310 -t ${REPO_NAME}:${LATEST_TAG}-py310"
+    DOCKER_TAGS="-t ${MAIN_UNIQUE_TAG} -t ${REPO_NAME}:${SHA}-py310 -t ${REPO_NAME}:${REFSPEC}-py310 -t ${REPO_NAME}:${LATEST_TAG}-py310"
     BUILD_TARGET="lean"
     BUILD_ARG="3.10-slim-bookworm"
     ;;
   "websocket")
-    DOCKER_TAGS="-t ${REPO_NAME}:${SHA}-websocket -t ${REPO_NAME}:${REFSPEC}-websocket -t ${REPO_NAME}:${LATEST_TAG}-websocket"
+    DOCKER_TAGS="-t ${MAIN_UNIQUE_TAG} -t ${REPO_NAME}:${SHA}-websocket -t ${REPO_NAME}:${REFSPEC}-websocket -t ${REPO_NAME}:${LATEST_TAG}-websocket"
     BUILD_TARGET=""
 	DOCKER_CONTEXT="superset-websocket"
     ;;
   "dockerize")
-    DOCKER_TAGS="-t ${REPO_NAME}:dockerize"
+    DOCKER_TAGS="-t ${MAIN_UNIQUE_TAG} -t ${REPO_NAME}:dockerize"
     BUILD_TARGET=""
 	DOCKER_CONTEXT="-f dockerize.Dockerfile ."
     ;;
@@ -102,6 +106,7 @@ esac
 
 cat<<EOF
   Rolling with tags:
+  - $MAIN_UNIQUE_TAG
   - ${REPO_NAME}:${SHA}
   - ${REPO_NAME}:${REFSPEC}
   - ${REPO_NAME}:${LATEST_TAG}
@@ -125,11 +130,14 @@ if [[ -n "${BUILD_TARGET}" ]]; then
   TARGET_ARGUMENT="--target ${BUILD_TARGET}"
 fi
 
+CACHE_REF="${REPO_NAME}-cache:${TARGET}-${BUILD_ARG}"
+CACHE_REF=$(echo "${CACHE_REF}" | tr -d '.')
+
 docker buildx build \
   ${TARGET_ARGUMENT} \
   ${DOCKER_ARGS} \
-  --cache-from=type=registry,ref=apache/superset:${TARGET} \
+  --cache-from=type=registry,ref=${CACHE_REF} \
-  --cache-to=type=registry,mode=max,ref=apache/superset:${TARGET} \
+  --cache-to=type=registry,mode=max,ref=${CACHE_REF} \
   ${DOCKER_TAGS} \
   --platform ${BUILD_PLATFORM} \
   --label "sha=${SHA}" \