[CI] Introduce guard job

.github/actions/ci-guard/action.yml

@@ -0,0 +1,23 @@
+name: Guard
+description: >
+  Loads the current PR title (not the stale event payload) and cancels the workflow when it
+  contains skip-ci, case-insensitive. No-op when the event is not pull_request.
+inputs:
+  github_token:
+    description: Token with actions:write and pull-requests:read
+    required: true
+runs:
+  using: composite
+  steps:
+    - run: |
+        set -euo pipefail
+        if [ "${{ github.event_name }}" != "pull_request" ]; then
+          exit 0
+        fi
+        PR_TITLE=$(gh pr view ${{ github.event.pull_request.number }} --repo "${{ github.repository }}" --json title --jq .title)
+        if printf '%s' "$PR_TITLE" | grep -Fqi 'skip-ci'; then
+          gh run cancel "${{ github.run_id }}" --repo "${{ github.repository }}"
+        fi
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github_token }}

.github/workflows/sdk-performance-metrics.yml

@@ -23,11 +23,15 @@ jobs:
   performance:
     name: Metrics
     runs-on: macos-15
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     env:
       GITHUB_TOKEN: '${{ secrets.CI_BOT_GITHUB_TOKEN }}'
     steps:
+      - uses: ./.github/actions/ci-guard
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Connect Bot
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
         uses: webfactory/ssh-agent@v0.7.0
         with:
           ssh-private-key: ${{ secrets.BOT_SSH_PRIVATE_KEY }}
@@ -37,18 +41,15 @@ jobs:
           python-version: 3.12 # gsutil requires Python version 3.8-3.12
 
       - uses: actions/checkout@v3.1.0
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
         with:
           fetch-depth: 0 # to fetch git tags
 
       - uses: ./.github/actions/bootstrap
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
         env:
           GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
           INSTALL_GCLOUD: true
 
       - name: Run XCMetrics
-        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
         run: bundle exec fastlane xcmetrics
         timeout-minutes: 120
         env:

.github/workflows/sdk-size-metrics.yml

@@ -20,10 +20,15 @@ jobs:
   sdk_size:
     name: Metrics
     runs-on: macos-15
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     env:
       GITHUB_TOKEN: '${{ secrets.CI_BOT_GITHUB_TOKEN }}'
       GITHUB_PR_NUM: ${{ github.event.pull_request.number }}
     steps:
+      - uses: ./.github/actions/ci-guard
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Connect Bot
         uses: webfactory/ssh-agent@v0.7.0
         with:

.github/workflows/smoke-checks.yml

@@ -26,9 +26,21 @@ env:
   GITHUB_PR_NUM: ${{ github.event.pull_request.number }}
 
 jobs:
+  guard:
+    name: Guard
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      pull-requests: read
+    steps:
+      - uses: ./.github/actions/ci-guard
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
   build-test-app-and-frameworks:
     name: Build Test App and Frameworks
     runs-on: macos-15
+    needs: guard
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: ./.github/actions/ruby-cache
@@ -48,6 +60,7 @@ jobs:
   automated-code-review:
     name: Automated Code Review
     runs-on: macos-14
+    needs: guard
     env:
       XCODE_VERSION: "16.1"
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
@@ -65,6 +78,7 @@ jobs:
     name: Build SDKs (Old Xcode)
     runs-on: macos-14
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
+    needs: guard
     env:
       XCODE_VERSION: "16.1"
     steps:
@@ -87,6 +101,7 @@ jobs:
     name: Test LLC (Debug)
     runs-on: macos-15
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
+    needs: guard
     steps:
     - uses: actions/checkout@v4.1.1
       with:
@@ -125,7 +140,9 @@ jobs:
   test-ui-debug:
     name: Test UI (Debug)
     runs-on: macos-15
-    needs: build-test-app-and-frameworks
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: actions/download-artifact@v4
@@ -158,7 +175,9 @@ jobs:
   test-common-ui-debug:
     name: Test Common UI (Debug)
     runs-on: macos-15
-    needs: build-test-app-and-frameworks
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: actions/download-artifact@v4
@@ -189,7 +208,9 @@ jobs:
     name: Launch Allure TestOps
     runs-on: macos-15
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
-    needs: build-test-app-and-frameworks
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     outputs:
       launch_id: ${{ steps.get_launch_id.outputs.launch_id }}
     steps:
@@ -209,6 +230,7 @@ jobs:
     runs-on: macos-15
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
     needs:
+      - guard
       - allure_testops_launch
       - build-test-app-and-frameworks
     env:
@@ -262,8 +284,10 @@ jobs:
   build-apps:
     name: Build Demo App + Example Apps
     runs-on: macos-15
-    needs: build-test-app-and-frameworks
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: actions/download-artifact@v4
@@ -291,8 +315,10 @@ jobs:
   test-integration:
     name: Test Integration
     runs-on: macos-15
-    needs: build-test-app-and-frameworks
     if: ${{ github.event.inputs.record_snapshots != 'true' }}
+    needs:
+      - guard
+      - build-test-app-and-frameworks
     steps:
     - uses: actions/checkout@v4.1.1
     - uses: actions/download-artifact@v4