Merge branch 'main' into add-verify-clean-pkl

Author: HT154

packages/pkl.impl.ghactions/PklCI.pkl

@@ -20,6 +20,7 @@ import "@gha/Context.pkl"
 import "@gha/Workflow.pkl"
 
 import "actions/PublishUnitTestResult.pkl"
+import "helpers.pkl"
 import "jobs/CheckPklEval.pkl"
 import "util.pkl"
 
@@ -408,6 +409,7 @@ local withPublishTestResultsForMultipleJobs: Mixin<Workflow.Jobs> = (it) -> (it)
   }
   ["publish-test-results"] {
     needs = it.keys.filter((key) -> testReports.includes(key)).toListing()
+    `if` = helpers.ifNoUpstreamFailures
     `runs-on` = "ubuntu-latest"
     permissions {
       checks = "write"
@@ -477,6 +479,8 @@ local function withTriggerWorkflows(triggerType: String): Mixin<Workflow.Jobs> =
       }
       `runs-on` = "ubuntu-latest"
       `if` = "github.repository_owner == 'apple'"
+      // NOTE: not using helpers.ifNoUpstreamFailures here because nothing should be skipped
+      // for release, releaseBranch, or main workflows
       steps {
         new {
           name = "Create app token"

packages/pkl.impl.ghactions/helpers.pkl

@@ -27,3 +27,19 @@ const withMavenPublishSecrets: Mixin<Workflow.Step> = new {
     ["ORG_GRADLE_PROJECT_sonatypeUsername"] = Context.secrets("ORG_GRADLE_PROJECT_SONATYPEUSERNAME")
   }
 }
+
+/// Use this for an `if` condition on jobs that "fan in" from multiple ancestors when one or more of
+/// those ancestors runs conditionally.
+///
+/// The four job states in GHA are:
+/// * success - completed successfully, checked by `success()`.
+/// * failure - ran unsuccessfully, checked by `failure()`.
+/// * cancelled - explicit user cancellation, checked by `cancelled()`.
+/// * skipped - skipped due to `if` condition, no check function.
+///
+/// Per [the docs](https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#status-check-functions):
+/// > A default status check of success() is applied unless you include one of these functions.
+///
+/// This condition overrides the default behavior to proceed if all ancestor jobs have result
+/// `success` or `skipped`.
+const ifNoUpstreamFailures: String = "!failure() && !cancelled()"