feat(ci): enforce e2e tests pass before publishing

.github/workflows/covector-version-or-publish.yml

@@ -19,7 +19,45 @@ permissions:
   pull-requests: write
 
 jobs:
+  # covector publishes once no change files are left (the version update PR consumed them) and
+  # otherwise opens that PR, which does not need the tests below.
+  check-publish:
+    runs-on: ubuntu-latest
+    outputs:
+      publish: ${{ steps.check.outputs.publish }}
+    steps:
+      - uses: actions/checkout@v7
+      - id: check
+        run: |
+          if find .changes -maxdepth 1 -name '*.md' ! -iname 'readme.md' | grep -q .; then
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  integration-tests:
+    needs: check-publish
+    if: needs.check-publish.outputs.publish == 'true'
+    uses: ./.github/workflows/integration-tests.yml
+
+  test-api-e2e:
+    needs: check-publish
+    if: needs.check-publish.outputs.publish == 'true'
+    uses: ./.github/workflows/test-api-e2e.yml
+    secrets: inherit
+
+  test-api-e2e-mobile:
+    needs: check-publish
+    if: needs.check-publish.outputs.publish == 'true'
+    uses: ./.github/workflows/test-api-e2e-mobile.yml
+
   version-or-publish:
+    needs:
+      - integration-tests
+      - test-api-e2e
+      - test-api-e2e-mobile
+    # the tests are skipped when covector only versions
+    if: ${{ !cancelled() && !failure() }}
     runs-on: ubuntu-latest
     timeout-minutes: 65
     outputs:

.github/workflows/integration-tests.yml

@@ -6,6 +6,8 @@ name: integration tests
 
 on:
   workflow_dispatch:
+  # run before publishing, see covector-version-or-publish.yml
+  workflow_call:
   push:
     branches:
       - v1

.github/workflows/test-api-e2e-mobile.yml

@@ -6,6 +6,8 @@ name: test plugins e2e (mobile)
 
 on:
   workflow_dispatch:
+  # run before publishing, see covector-version-or-publish.yml
+  workflow_call:
   push:
     branches:
       - v2
@@ -38,7 +40,9 @@ env:
   CARGO_PROFILE_DEV_DEBUG: 0 # keeps the target folder small for better cache efficiency
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  # `github.workflow` is the caller's name in a `workflow_call` run, so the suffix keeps the
+  # desktop and mobile suites from sharing (and cancelling) one group there.
+  group: ${{ github.workflow }}-api-e2e-mobile-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:

.github/workflows/test-api-e2e.yml

@@ -6,6 +6,8 @@ name: test plugins e2e
 
 on:
   workflow_dispatch:
+  # run before publishing, see covector-version-or-publish.yml
+  workflow_call:
   push:
     branches:
       - v2
@@ -35,7 +37,9 @@ env:
   MSEDGEDRIVER_TOOL_REV: 8c4b34f51b45f5cf08013366d703de464ab871d1
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  # `github.workflow` is the caller's name in a `workflow_call` run, so the suffix keeps the
+  # desktop and mobile suites from sharing (and cancelling) one group there.
+  group: ${{ github.workflow }}-api-e2e-${{ github.ref }}
   cancel-in-progress: true
 
 permissions: