From b870626a5ea0153e54705554404e0342e7ea1c18 Mon Sep 17 00:00:00 2001
From: Lucas Nogueira <lucas@tauri.app>
Date: Fri, 25 Sep 2026 13:27:31 -0300
Subject: [PATCH] feat(ci): enforce e2e tests pass before publishing

---
 .../workflows/covector-version-or-publish.yml | 38 +++++++++++++++++++
 .github/workflows/integration-tests.yml       |  2 +
 .github/workflows/test-api-e2e-mobile.yml     |  6 ++-
 .github/workflows/test-api-e2e.yml            |  6 ++-
 4 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/covector-version-or-publish.yml b/.github/workflows/covector-version-or-publish.yml
index ca563b52d..0e58b55b7 100644
--- a/.github/workflows/covector-version-or-publish.yml
+++ b/.github/workflows/covector-version-or-publish.yml
@@ -19,7 +19,45 @@ permissions:
   pull-requests: write
 
 jobs:
+  # covector publishes once no change files are left (the version update PR consumed them) and
+  # otherwise opens that PR, which does not need the tests below.
+  check-publish:
+    runs-on: ubuntu-latest
+    outputs:
+      publish: ${{ steps.check.outputs.publish }}
+    steps:
+      - uses: actions/checkout@v7
+      - id: check
+        run: |
+          if find .changes -maxdepth 1 -name '*.md' ! -iname 'readme.md' | grep -q .; then
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  integration-tests:
+    needs: check-publish
+    if: needs.check-publish.outputs.publish == 'true'
+    uses: ./.github/workflows/integration-tests.yml
+
+  test-api-e2e:
+    needs: check-publish
+    if: needs.check-publish.outputs.publish == 'true'
+    uses: ./.github/workflows/test-api-e2e.yml
+    secrets: inherit
+
+  test-api-e2e-mobile:
+    needs: check-publish
+    if: needs.check-publish.outputs.publish == 'true'
+    uses: ./.github/workflows/test-api-e2e-mobile.yml
+
   version-or-publish:
+    needs:
+      - integration-tests
+      - test-api-e2e
+      - test-api-e2e-mobile
+    # the tests are skipped when covector only versions
+    if: ${{ !cancelled() && !failure() }}
     runs-on: ubuntu-latest
     timeout-minutes: 65
     outputs:
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 27993d2fc..7408c9997 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -6,6 +6,8 @@ name: integration tests
 
 on:
   workflow_dispatch:
+  # run before publishing, see covector-version-or-publish.yml
+  workflow_call:
   push:
     branches:
       - v1
diff --git a/.github/workflows/test-api-e2e-mobile.yml b/.github/workflows/test-api-e2e-mobile.yml
index c73cb89c6..7a97a15be 100644
--- a/.github/workflows/test-api-e2e-mobile.yml
+++ b/.github/workflows/test-api-e2e-mobile.yml
@@ -6,6 +6,8 @@ name: test plugins e2e (mobile)
 
 on:
   workflow_dispatch:
+  # run before publishing, see covector-version-or-publish.yml
+  workflow_call:
   push:
     branches:
       - v2
@@ -38,7 +40,9 @@ env:
   CARGO_PROFILE_DEV_DEBUG: 0 # keeps the target folder small for better cache efficiency
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  # `github.workflow` is the caller's name in a `workflow_call` run, so the suffix keeps the
+  # desktop and mobile suites from sharing (and cancelling) one group there.
+  group: ${{ github.workflow }}-api-e2e-mobile-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
diff --git a/.github/workflows/test-api-e2e.yml b/.github/workflows/test-api-e2e.yml
index 3c18ad54b..248997345 100644
--- a/.github/workflows/test-api-e2e.yml
+++ b/.github/workflows/test-api-e2e.yml
@@ -6,6 +6,8 @@ name: test plugins e2e
 
 on:
   workflow_dispatch:
+  # run before publishing, see covector-version-or-publish.yml
+  workflow_call:
   push:
     branches:
       - v2
@@ -35,7 +37,9 @@ env:
   MSEDGEDRIVER_TOOL_REV: 8c4b34f51b45f5cf08013366d703de464ab871d1
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  # `github.workflow` is the caller's name in a `workflow_call` run, so the suffix keeps the
+  # desktop and mobile suites from sharing (and cancelling) one group there.
+  group: ${{ github.workflow }}-api-e2e-${{ github.ref }}
   cancel-in-progress: true
 
 permissions: