ci: run PR builds in fork and mirror status to apache repo

.asf.yaml

@@ -67,10 +67,8 @@ github:
       required_status_checks:
         # strict means "Require branches to be up to date before merging".
         strict: true
-        # contexts are the names of checks that must pass
         contexts:
-          - Required Checks
-          - Check License Headers
+          - Build
           - Validate PR title
       required_pull_request_reviews:
         dismiss_stale_reviews: false

.github/workflows/automatic-email-notif-on-ddl-change.yml

@@ -16,33 +16,75 @@
 
 name: Automatic email notification on DDL change
 
+# Triggered post-merge on push to main when sql/updates/** changes. Was
+# previously `pull_request: closed`, which queued for first-time-contributor
+# approval on every fork PR even though the job condition (`merged == true`)
+# meant it never actually ran on PR open. Push trigger fires only on actual
+# main-branch updates and needs no approval.
 on:
-  pull_request:
-    types:
-      - closed
+  push:
+    branches: [main]
+    paths:
+      - 'sql/updates/**'
+
+permissions:
+  contents: read
+  pull-requests: read
 
 jobs:
   notify:
-    if: >-
-      github.event.pull_request.merged == true && 
-      contains(github.event.pull_request.labels.*.name, 'ddl-change')
     runs-on: ubuntu-latest
     steps:
+      - name: Resolve PR for this commit
+        id: pr
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const pulls = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              commit_sha: context.sha,
+            })
+            const pr = pulls.data[0]
+            if (!pr) {
+              console.log('No PR associated with ' + context.sha + '; skipping email')
+              core.setOutput('skip', 'true')
+              return
+            }
+            const hasLabel = pr.labels.some(l => l.name === 'ddl-change')
+            if (!hasLabel) {
+              console.log('PR #' + pr.number + ' has no ddl-change label; skipping email')
+              core.setOutput('skip', 'true')
+              return
+            }
+            core.setOutput('skip', 'false')
+            core.setOutput('number', String(pr.number))
+            core.setOutput('title', pr.title)
+            core.setOutput('html_url', pr.html_url)
+            core.setOutput('user', pr.user.login)
+
       - name: Checkout
+        if: steps.pr.outputs.skip == 'false'
         uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 2
           sparse-checkout: sql/updates/
 
-      - name: Get added file in sql/updates/
+      - name: Find added SQL update file
+        if: steps.pr.outputs.skip == 'false'
         id: get_sql_file
         run: |
-          FILE=$(git diff --name-only --diff-filter=A \
-            ${{ github.event.pull_request.base.sha }} \
-            ${{ github.event.pull_request.merge_commit_sha }} \
-            -- 'sql/updates/')
+          FILE=$(git diff --name-only --diff-filter=A HEAD~1 HEAD -- 'sql/updates/')
           echo "sql_file=$FILE" >> $GITHUB_OUTPUT
+
       - name: Send email
+        if: steps.pr.outputs.skip == 'false'
+        env:
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+          PR_TITLE: ${{ steps.pr.outputs.title }}
+          PR_URL: ${{ steps.pr.outputs.html_url }}
+          PR_USER: ${{ steps.pr.outputs.user }}
+          SQL_FILE: ${{ steps.get_sql_file.outputs.sql_file }}
         run: |
           curl --ssl-reqd \
             --url "smtps://smtp.gmail.com:465" \
@@ -57,6 +99,6 @@ jobs:
           Content-Type: text/html
 
           <p>Hi all,</p>
-          <p>We have merged PR #${{ github.event.pull_request.number }} (<a href="${{ github.event.pull_request.html_url }}">${{ github.event.pull_request.html_url }}</a>): ${{ github.event.pull_request.title }}. To incorporate the change, please apply ${{ steps.get_sql_file.outputs.sql_file }} to your local Postgres instance and run <code>sbt jooqGenerate</code> to generate jooq classes.</p>
-          <p>Best,<br>${{ github.event.pull_request.user.login }}</p>
-          EOF
+          <p>We have merged PR #${PR_NUMBER} (<a href="${PR_URL}">${PR_URL}</a>): ${PR_TITLE}. To incorporate the change, please apply ${SQL_FILE} to your local Postgres instance and run <code>sbt jooqGenerate</code> to generate jooq classes.</p>
+          <p>Best,<br>${PR_USER}</p>
+          EOF

.github/workflows/check-header.yml

@@ -21,7 +21,6 @@ on:
     branches:
       - 'ci-enable/**'
       - 'main'
-  pull_request:
   workflow_dispatch:
 
 jobs:

.github/workflows/fork-ci.yml

@@ -0,0 +1,99 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Fork CI — Apache Spark model
+#
+# Runs the full PR-gating suite in the contributor's fork on every branch
+# push. Mirrors what required-checks.yml runs in apache/texera on a
+# ci-enable/** push: build matrix + license headers, aggregated into a
+# single "fork-ci" result that notify_test_workflow.yml surfaces on the PR
+# as the "Build" commit status.
+#
+# This workflow is a no-op in the canonical apache/texera repository —
+# every job is guarded by (github.repository_owner != 'apache') so it
+# never consumes main-repo runner quota.
+#
+# Secrets (CODECOV_TOKEN, NX_CLOUD_ACCESS_TOKEN) are unavailable in forks
+# and degrade gracefully: Codecov uploads are skipped (fail_ci_if_error:
+# false) and NX Cloud remote caching is disabled; builds still pass.
+
+name: Fork CI
+
+on:
+  push:
+    branches-ignore:
+      - main
+      - 'release/**'
+      - 'ci-enable/**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    if: github.repository_owner != 'apache'
+    uses: ./.github/workflows/build.yml
+    with:
+      run_frontend: true
+      run_amber: true
+      run_amber_integration: true
+      run_platform: true
+      run_python: true
+      run_agent_service: true
+    secrets: inherit
+
+  check-headers:
+    name: Check License Headers
+    if: github.repository_owner != 'apache'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: apache/skywalking-eyes@5c5b974209f0de5d905f37deb69369068ebfc15c # v0.7.0
+
+  fork-ci:
+    # Aggregator job — its conclusion is what notify_test_workflow.yml
+    # mirrors as the PR's "Build" status. Mirrors required-checks.yml's
+    # final required-checks job. Runs even if upstream jobs failed so the
+    # aggregate result is always reported.
+    name: Fork CI
+    needs: [build, check-headers]
+    if: always() && github.repository_owner != 'apache'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify all fork CI jobs succeeded or were skipped
+        run: |
+          declare -A results=(
+            [build]="${{ needs.build.result }}"
+            [check-headers]="${{ needs.check-headers.result }}"
+          )
+          failed=0
+          for job in "${!results[@]}"; do
+            r="${results[$job]}"
+            echo "${job}: ${r}"
+            if [[ "$r" != "success" && "$r" != "skipped" ]]; then
+              failed=1
+            fi
+          done
+          if (( failed )); then
+            echo "::error::One or more fork CI jobs did not succeed."
+            exit 1
+          fi
+          echo "All fork CI jobs succeeded or were skipped."