[CI] Introduce guard job (#4047)

Author: testableapple

.github/actions/ci-guard/action.yml

@@ -0,0 +1,23 @@
+name: Guard
+description: >
+  Loads the current PR title (not the stale event payload) and cancels the workflow when it
+  contains skip-ci, case-insensitive. No-op when the event is not pull_request.
+inputs:
+  github_token:
+    description: Token with actions:write and pull-requests:read
+    required: true
+runs:
+  using: composite
+  steps:
+    - run: |
+        set -euo pipefail
+        if [ "${{ github.event_name }}" != "pull_request" ]; then
+          exit 0
+        fi
+        PR_TITLE=$(gh pr view ${{ github.event.pull_request.number }} --repo "${{ github.repository }}" --json title --jq .title)
+        if printf '%s' "$PR_TITLE" | grep -Fqi 'skip-ci'; then
+          gh run cancel "${{ github.run_id }}" --repo "${{ github.repository }}"
+        fi
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github_token }}

.github/workflows/sdk-performance-metrics.yml

@@ -23,11 +23,19 @@ jobs:
   performance:
     name: Metrics
     runs-on: macos-15
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     env:
       GITHUB_TOKEN: '${{ secrets.CI_BOT_GITHUB_TOKEN }}'
     steps:
+      - uses: actions/checkout@v3.1.0
+        with:
+          fetch-depth: 0 # to fetch git tags
+
+      - uses: ./.github/actions/ci-guard
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Connect Bot
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
         uses: webfactory/ssh-agent@v0.7.0
         with:
           ssh-private-key: ${{ secrets.BOT_SSH_PRIVATE_KEY }}
@@ -36,19 +44,12 @@ jobs:
         with:
           python-version: 3.12 # gsutil requires Python version 3.8-3.12
 
-      - uses: actions/checkout@v3.1.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
-        with:
-          fetch-depth: 0 # to fetch git tags
-
       - uses: ./.github/actions/bootstrap
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
         env:
           GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
           INSTALL_GCLOUD: true
 
       - name: Run XCMetrics
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
         run: bundle exec fastlane xcmetrics
         timeout-minutes: 120
         env:

.github/workflows/sdk-size-metrics.yml

@@ -20,17 +20,22 @@ jobs:
   sdk_size:
     name: Metrics
     runs-on: macos-15
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     env:
       GITHUB_TOKEN: '${{ secrets.CI_BOT_GITHUB_TOKEN }}'
       GITHUB_PR_NUM: ${{ github.event.pull_request.number }}
     steps:
+      - uses: actions/checkout@v3.1.0
+
+      - uses: ./.github/actions/ci-guard
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Connect Bot
         uses: webfactory/ssh-agent@v0.7.0
         with:
           ssh-private-key: ${{ secrets.BOT_SSH_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v3.1.0
-
       - uses: ./.github/actions/bootstrap
 
       - name: Run General SDK Size Metrics

.github/workflows/smoke-checks.yml

@@ -26,9 +26,19 @@ env:
   GITHUB_PR_NUM: ${{ github.event.pull_request.number }}
 
 jobs:
+  guard:
+    name: Guard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.1.1
+      - uses: ./.github/actions/ci-guard
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
   build-test-app-and-frameworks:
     name: Build Test App and Frameworks
     runs-on: macos-15
+    needs: guard
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: ./.github/actions/ruby-cache
@@ -48,6 +58,7 @@ jobs:
   automated-code-review:
     name: Automated Code Review
     runs-on: macos-14
+    needs: guard
     env:
       XCODE_VERSION: "16.1"
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
@@ -65,6 +76,7 @@ jobs:
     name: Build SDKs (Old Xcode)
     runs-on: macos-14
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
+    needs: guard
     env:
       XCODE_VERSION: "16.1"
     steps:
@@ -87,6 +99,7 @@ jobs:
     name: Test LLC (Debug)
     runs-on: macos-15
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
+    needs: guard
     steps:
     - uses: actions/checkout@v4.1.1
       with:
@@ -125,7 +138,9 @@ jobs:
   test-ui-debug:
     name: Test UI (Debug)
     runs-on: macos-15
-    needs: build-test-app-and-frameworks
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: actions/download-artifact@v4
@@ -158,7 +173,9 @@ jobs:
   test-common-ui-debug:
     name: Test Common UI (Debug)
     runs-on: macos-15
-    needs: build-test-app-and-frameworks
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: actions/download-artifact@v4
@@ -189,7 +206,9 @@ jobs:
     name: Launch Allure TestOps
     runs-on: macos-15
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
-    needs: build-test-app-and-frameworks
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     outputs:
       launch_id: ${{ steps.get_launch_id.outputs.launch_id }}
     steps:
@@ -209,6 +228,7 @@ jobs:
     runs-on: macos-15
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
     needs:
+      - guard
       - allure_testops_launch
       - build-test-app-and-frameworks
     env:
@@ -262,8 +282,10 @@ jobs:
   build-apps:
     name: Build Demo App + Example Apps
     runs-on: macos-15
-    needs: build-test-app-and-frameworks
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: actions/download-artifact@v4
@@ -291,8 +313,10 @@ jobs:
   test-integration:
     name: Test Integration
     runs-on: macos-15
-    needs: build-test-app-and-frameworks
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: actions/download-artifact@v4