workflows: run release artifact build checks from ci.yaml

.github/workflows/ci.yaml

@@ -30,3 +30,8 @@ jobs:
         with:
           version: 0.15.14
           args: format --check --exclude testdata
+
+  build_release_artifacts:
+    name: Build release artifacts
+    uses: ./.github/workflows/release_build_artifacts.yaml
+    secrets: inherit

.github/workflows/release_build_artifacts.yaml

@@ -12,12 +12,11 @@
 name: "Release: Build Artifacts"
 
 on:
-  pull_request:
   workflow_call:
     inputs:
       ref:
-        description: "The git ref (e.g. release tag) to build"
-        required: true
+        description: "The git ref (e.g. release tag) to build. Defaults to the selected ref."
+        required: false
         type: string
   workflow_dispatch:
     inputs:
@@ -132,7 +131,7 @@ jobs:
         env:
           INPUT_REF: ${{ inputs.ref }}
         # ${INPUT_REF:+...} expands to the --stamp and --embed_label flags only
-        # when INPUT_REF is non-empty (release builds, not pull_request builds).
+        # when INPUT_REF is non-empty (release builds, not CI builds).
         run: >-
           bazel build
           ${INPUT_REF:+--stamp "--embed_label=$INPUT_REF"}

tests/workflows/release_build_artifacts_test.py

@@ -49,12 +49,23 @@ def test_matrix_matches_dev_platforms():
 
 
 def test_workflow_is_safe_for_presubmit():
-    """Verifies that release_build_artifacts.yaml is read-only and never publishes."""
+    """Verifies that release_build_artifacts.yaml is read-only, never publishes,
+    and is called by ci.yaml.
+    """
     workflow = _load_workflow()
 
     # PyYAML parses unquoted `on:` as boolean True in YAML 1.1.
     triggers = workflow.get("on") or workflow.get(True, {})
-    assert "pull_request" in triggers
+    assert set(triggers.keys()) == {"workflow_call", "workflow_dispatch"}
+    assert not triggers["workflow_call"]["inputs"]["ref"].get("required", False)
+
+    ci_workflow = _load_workflow("ci.yaml")
+    ci_triggers = ci_workflow.get("on") or ci_workflow.get(True, {})
+    assert "pull_request" in ci_triggers
+    assert "push" in ci_triggers
+    ci_job = ci_workflow["jobs"]["build_release_artifacts"]
+    assert ci_job["uses"] == "./.github/workflows/release_build_artifacts.yaml"
+    assert ci_job.get("secrets") == "inherit"
 
     assert workflow.get("permissions") == {"contents": "read"}