From 97aa3cee8875aea2e029483d51fa8755d6e17918 Mon Sep 17 00:00:00 2001
From: Matheus Macabu <macabu@users.noreply.github.com>
Date: Fri, 25 Jul 2025 15:10:54 +0200
Subject: [PATCH] GHA: Run Go Workspace Checks conditionally on BE changes
 (#108655)

---
 .github/actions/change-detection/action.yml |  4 ++
 .github/workflows/pr-go-workspace-check.yml | 61 +++++++++++++++++----
 2 files changed, 55 insertions(+), 10 deletions(-)

diff --git a/.github/actions/change-detection/action.yml b/.github/actions/change-detection/action.yml
index b8864e985e2..e2c3a6c3b89 100644
--- a/.github/actions/change-detection/action.yml
+++ b/.github/actions/change-detection/action.yml
@@ -47,6 +47,10 @@ runs:
             - '.github/actions/checkout/**'
             - '**/go.mod'
             - '**/go.sum'
+            - 'go.mod'
+            - 'go.sum'
+            - 'go.work'
+            - 'go.work.sum'
             - '**.go'
             - 'pkg/**'
             - '!pkg/**.md'
diff --git a/.github/workflows/pr-go-workspace-check.yml b/.github/workflows/pr-go-workspace-check.yml
index f7b148ac83d..91dc3037f11 100644
--- a/.github/workflows/pr-go-workspace-check.yml
+++ b/.github/workflows/pr-go-workspace-check.yml
@@ -4,18 +4,31 @@ on:
   workflow_dispatch:
   pull_request:
     branches: [main]
-    paths:
-      - .github/workflows/pr-go-workspace-check.yml
-      - go.mod
-      - go.sum
-      - go.work
-      - go.work.sum
-      - '**/go.mod'
-      - '**/go.sum'
-      - '**.go'
+
+permissions: {}
 
 jobs:
-  check:
+  detect-changes:
+    name: Detect whether code changed
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      changed: ${{ steps.detect-changes.outputs.backend }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: true # required to get more history in the changed-files action
+          fetch-depth: 2
+      - name: Detect changes
+        id: detect-changes
+        uses: ./.github/actions/change-detection
+        with:
+          self: .github/workflows/pr-go-workspace-check.yml
+
+  check-workspace:
+    needs: detect-changes
+    if: needs.detect-changes.outputs.changed == 'true'
     name: Go Workspace Check
     runs-on: ubuntu-latest
 
@@ -47,6 +60,8 @@ jobs:
       run: ./scripts/go-workspace/validate-dockerfile.sh
 
   check-wire:
+    needs: detect-changes
+    if: needs.detect-changes.outputs.changed == 'true'
     name: Check Wire Changes
     runs-on: ubuntu-latest
 
@@ -114,3 +129,29 @@ jobs:
           fi
           exit 1
         fi
+
+  # This is the job that is actually required by rulesets.
+  # We want to only require one job instead of all the individual tests.
+  # Future work also allows us to start skipping some tests based on changed files.
+  required-go-workspace-check:
+    needs:
+      - check-workspace
+      - check-wire
+    # always() is the best function here.
+    # success() || failure() will skip this function if any need is also skipped.
+    # That means conditional jobs will fail the entire requirement check.
+    if: always()
+
+    name: All Go Workspace Checks complete
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check the checks
+        env:
+          NEEDS: ${{ toJson(needs) }}
+        run: |
+          FAILURES="$(echo "$NEEDS" | jq 'with_entries(select(.value.result == "failure")) | map_values(.result)')"
+          echo "$FAILURES"
+          if [ "$(echo "$FAILURES" | jq '. | length')" != "0" ]; then
+            exit 1
+          fi
+          echo "All OK!"