From dfa69dce5ce4f678501135d48719ec86ce1f9ed7 Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Sun, 1 Nov 2026 12:20:16 -0800
Subject: [PATCH] workflows: run release artifact build checks from ci.yaml

Release workflows should not trigger directly on pull request or push
events; CI checks belong in the CI workflow.

Remove the `pull_request` trigger from `release_build_artifacts.yaml`,
make its `workflow_call` `ref` input optional, and invoke it as a
reusable workflow job from `ci.yaml`.
---
 .github/workflows/ci.yaml                       |  5 +++++
 .github/workflows/release_build_artifacts.yaml  |  7 +++----
 tests/workflows/release_build_artifacts_test.py | 15 +++++++++++++--
 3 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7990f652e6..48bb5a121f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -30,3 +30,8 @@ jobs:
         with:
           version: 0.15.14
           args: format --check --exclude testdata
+
+  build_release_artifacts:
+    name: Build release artifacts
+    uses: ./.github/workflows/release_build_artifacts.yaml
+    secrets: inherit
diff --git a/.github/workflows/release_build_artifacts.yaml b/.github/workflows/release_build_artifacts.yaml
index 32a96803b3..b4ea7fd246 100644
--- a/.github/workflows/release_build_artifacts.yaml
+++ b/.github/workflows/release_build_artifacts.yaml
@@ -12,12 +12,11 @@
 name: "Release: Build Artifacts"
 
 on:
-  pull_request:
   workflow_call:
     inputs:
       ref:
-        description: "The git ref (e.g. release tag) to build"
-        required: true
+        description: "The git ref (e.g. release tag) to build. Defaults to the selected ref."
+        required: false
         type: string
   workflow_dispatch:
     inputs:
@@ -132,7 +131,7 @@ jobs:
         env:
           INPUT_REF: ${{ inputs.ref }}
         # ${INPUT_REF:+...} expands to the --stamp and --embed_label flags only
-        # when INPUT_REF is non-empty (release builds, not pull_request builds).
+        # when INPUT_REF is non-empty (release builds, not CI builds).
         run: >-
           bazel build
           ${INPUT_REF:+--stamp "--embed_label=$INPUT_REF"}
diff --git a/tests/workflows/release_build_artifacts_test.py b/tests/workflows/release_build_artifacts_test.py
index ad933a1b60..d0a7279c73 100644
--- a/tests/workflows/release_build_artifacts_test.py
+++ b/tests/workflows/release_build_artifacts_test.py
@@ -49,12 +49,23 @@ def test_matrix_matches_dev_platforms():
 
 
 def test_workflow_is_safe_for_presubmit():
-    """Verifies that release_build_artifacts.yaml is read-only and never publishes."""
+    """Verifies that release_build_artifacts.yaml is read-only, never publishes,
+    and is called by ci.yaml.
+    """
     workflow = _load_workflow()
 
     # PyYAML parses unquoted `on:` as boolean True in YAML 1.1.
     triggers = workflow.get("on") or workflow.get(True, {})
-    assert "pull_request" in triggers
+    assert set(triggers.keys()) == {"workflow_call", "workflow_dispatch"}
+    assert not triggers["workflow_call"]["inputs"]["ref"].get("required", False)
+
+    ci_workflow = _load_workflow("ci.yaml")
+    ci_triggers = ci_workflow.get("on") or ci_workflow.get(True, {})
+    assert "pull_request" in ci_triggers
+    assert "push" in ci_triggers
+    ci_job = ci_workflow["jobs"]["build_release_artifacts"]
+    assert ci_job["uses"] == "./.github/workflows/release_build_artifacts.yaml"
+    assert ci_job.get("secrets") == "inherit"
 
     assert workflow.get("permissions") == {"contents": "read"}