From 578dc66f2659afce781c9e56e91dada95aa11374 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 13:47:52 -0700
Subject: [PATCH 01/15] feat: support testing on forked repos

---
 .github/workflows/custard-ci-dev.yaml  |   2 +-
 .github/workflows/custard-ci.yaml      |   3 +-
 .github/workflows/custard-run-dev.yaml | 124 +++++++++++++++++++
 .github/workflows/custard-run.yaml     | 163 +++++++++++++++++++++++++
 4 files changed, 290 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/custard-run-dev.yaml
 create mode 100644 .github/workflows/custard-run.yaml

diff --git a/.github/workflows/custard-ci-dev.yaml b/.github/workflows/custard-ci-dev.yaml
index 7f4c40641e..e309fa73d9 100644
--- a/.github/workflows/custard-ci-dev.yaml
+++ b/.github/workflows/custard-ci-dev.yaml
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-name: custard CI (dev)
+name: Custard CI (dev)
 on:
   push:
     branches:
diff --git a/.github/workflows/custard-ci.yaml b/.github/workflows/custard-ci.yaml
index 2e85d1218c..4e509380a7 100644
--- a/.github/workflows/custard-ci.yaml
+++ b/.github/workflows/custard-ci.yaml
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-name: custard CI
+name: Custard CI
 on:
   push:
     branches:
@@ -25,6 +25,7 @@ on:
 env:
   GO_VERSION: ^1.22.0
 
+# TODO: remove all jobs except region-tags (should be tested by custard-run workflows)
 jobs:
   affected:
     name: Finding affected tests
diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
new file mode 100644
index 0000000000..caadc26661
--- /dev/null
+++ b/.github/workflows/custard-run-dev.yaml
@@ -0,0 +1,124 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Custard run (dev)
+
+on:
+  push:
+    branches:
+      - main
+  workflow_run:
+    workflows:
+      - Custard CI # .github/workflows/custard-ci.yaml
+    types:
+      - in_progress
+  workflow_dispatch:
+    inputs:
+      run-all:
+        description: Run all tests
+        type: boolean
+        default: false
+      paths:
+        description: Comma separated packages to test
+        type: string
+      ref:
+        description: Branch, tag, or commit SHA to run tests on
+        type: string
+        default: main
+  # schedule:
+  #   # https://crontab.guru/#0_12_*_*_0
+  #   - cron: 0 12 * * 0 # At 12:00 on Sunday
+
+jobs:
+  affected:
+    uses: GoogleCloudPlatform/cloud-samples-tools/.github/workflows/affected.yaml@v0.2.3
+    permissions:
+      statuses: write
+    with:
+      head-sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
+      config-file: .github/config/nodejs-dev.jsonc
+      paths: ${{ (inputs.run-all && '.') || inputs.paths || '' }}
+      create-check-if: ${{ !!github.event.workflow_run }}
+
+  test:
+    needs: affected
+    runs-on: ubuntu-latest
+    timeout-minutes: 120 # 2 hours hard limit
+    permissions:
+      statuses: write
+    strategy:
+      fail-fast: false
+      matrix:
+        path: ${{ needs.affected.outputs.paths }}
+    continue-on-error: true
+    env:
+      GOOGLE_SAMPLES_PROJECT: long-door-651
+      GOOGLE_SERVICE_ACCOUNT: kokoro-system-test@long-door-651.iam.gserviceaccount.com
+    steps:
+      - name: Check queued
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/create-check@v0.2.3
+        id: queued
+        with:
+          sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
+          name: Custard CI / ${{ github.job }} (${{ matrix.path }})
+          job-name: ${{ github.job }} (${{ matrix.path }})
+          if: ${{ !!github.event.workflow_run }}
+      - name: Setup Custard
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/setup-custard@v0.2.3
+        with:
+          path: ${{ matrix.path }}
+          ci-setup: ${{ toJson(fromJson(needs.affected.outputs.ci-setups)[matrix.path]) }}
+          project-id: ${{ env.GOOGLE_SAMPLES_PROJECT }}
+          workload-identity-provider: projects/1046198160504/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider
+          service-account: ${{ env.GOOGLE_SERVICE_ACCOUNT }}
+      - name: Check in_progress
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        id: in_progress
+        with:
+          check: ${{ steps.queued.outputs.check }}
+          status: in_progress
+      - name: Run tests for ${{ matrix.path }}
+        run: |
+          timeout ${{ fromJson(needs.affected.outputs.ci-setups)[matrix.path].timeout-minutes }}m \
+            make test dir=${{ matrix.path }}
+      - name: Check success
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        with:
+          check: ${{ steps.in_progress.outputs.check }}
+          status: success
+      - name: Check failure
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        if: failure()
+        with:
+          check: ${{ steps.in_progress.outputs.check }}
+          status: failure
+      # - name: Upload test results for FlakyBot workflow
+      #   if: github.event.action == 'schedule' && always() # always() submits logs even if tests fail
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: test-results
+      #     path: ${{ matrix.path }}/${{ github.run_id }}_sponge_log.xml
+      #     retention-days: 1
+
+  done:
+    needs: [affected, test]
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    steps:
+      - name: Check success
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        with:
+          check: ${{ needs.affected.outputs.check }}
+          status: success
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
new file mode 100644
index 0000000000..e1a75d6439
--- /dev/null
+++ b/.github/workflows/custard-run.yaml
@@ -0,0 +1,163 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Custard run
+
+on:
+  push:
+    branches:
+      - main
+  workflow_run:
+    workflows:
+      - Custard CI # .github/workflows/custard-ci.yaml
+    types:
+      - in_progress
+  workflow_dispatch:
+    inputs:
+      run-all:
+        description: Run all tests
+        type: boolean
+        default: false
+      paths:
+        description: Comma separated packages to test
+        type: string
+      ref:
+        description: Branch, tag, or commit SHA to run tests on
+        type: string
+        default: main
+  # schedule:
+  #   # https://crontab.guru/#0_12_*_*_0
+  #   - cron: 0 12 * * 0 # At 12:00 on Sunday
+
+jobs:
+  affected:
+    uses: GoogleCloudPlatform/cloud-samples-tools/.github/workflows/affected.yaml@v0.2.3
+    permissions:
+      statuses: write
+    with:
+      head-sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
+      config-file: .github/config/nodejs.jsonc
+      paths: ${{ (inputs.run-all && '.') || inputs.paths || '' }}
+      create-check-if: ${{ !!github.event.workflow_run }}
+
+  lint:
+    needs: affected
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    timeout-minutes: 5
+    steps:
+      - name: Check in_progress
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/create-check@v0.2.3
+        id: in_progress
+        with:
+          sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
+          status: in_progress
+          name: Custard CI / ${{ github.job }}
+          if: ${{ !!github.event.workflow_run }}
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - name: Setup Node
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
+        with:
+          node-version: 20
+      - run: npm install
+      - name: npx gtx lint (${{ needs.affected.outputs.num-paths }} packages)
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/map-run@v0.2.3
+        with:
+          command: npx gts lint
+          paths: ${{ needs.affected.outputs.paths }}
+      - name: Check success
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        with:
+          check: ${{ steps.in_progress.outputs.check }}
+          status: success
+      - name: Check failure
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        if: failure()
+        with:
+          check: ${{ steps.in_progress.outputs.check }}
+          status: failure
+
+  test:
+    needs: affected
+    runs-on: ubuntu-latest
+    timeout-minutes: 120 # 2 hours hard limit
+    permissions:
+      statuses: write
+    strategy:
+      fail-fast: false
+      matrix:
+        path: ${{ needs.affected.outputs.paths }}
+    continue-on-error: true
+    env:
+      GOOGLE_SAMPLES_PROJECT: long-door-651
+      GOOGLE_SERVICE_ACCOUNT: kokoro-system-test@long-door-651.iam.gserviceaccount.com
+    steps:
+      - name: Check queued
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/create-check@v0.2.3
+        id: queued
+        with:
+          sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
+          name: Custard CI / ${{ github.job }} (${{ matrix.path }})
+          job-name: ${{ github.job }} (${{ matrix.path }})
+          if: ${{ !!github.event.workflow_run }}
+      - name: Setup Custard
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/setup-custard@v0.2.3
+        with:
+          path: ${{ matrix.path }}
+          ci-setup: ${{ toJson(fromJson(needs.affected.outputs.ci-setups)[matrix.path]) }}
+          project-id: ${{ env.GOOGLE_SAMPLES_PROJECT }}
+          workload-identity-provider: projects/1046198160504/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider
+          service-account: ${{ env.GOOGLE_SERVICE_ACCOUNT }}
+      - name: Check in_progress
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        id: in_progress
+        with:
+          check: ${{ steps.queued.outputs.check }}
+          status: in_progress
+      - name: Run tests for ${{ matrix.path }}
+        run: |
+          timeout ${{ fromJson(needs.affected.outputs.ci-setups)[matrix.path].timeout-minutes }}m \
+            make test dir=${{ matrix.path }}
+      - name: Check success
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        with:
+          check: ${{ steps.in_progress.outputs.check }}
+          status: success
+      - name: Check failure
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        if: failure()
+        with:
+          check: ${{ steps.in_progress.outputs.check }}
+          status: failure
+      # - name: Upload test results for FlakyBot workflow
+      #   if: github.event.action == 'schedule' && always() # always() submits logs even if tests fail
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: test-results
+      #     path: ${{ matrix.path }}/${{ github.run_id }}_sponge_log.xml
+      #     retention-days: 1
+
+  done:
+    needs: [affected, lint, test]
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    steps:
+      - name: Check success
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        with:
+          check: ${{ needs.affected.outputs.check }}
+          status: success

From 9a570030e35409b9aee74483c8e7adbd8e74c955 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 14:10:18 -0700
Subject: [PATCH 02/15] add pull_request to test on PR

---
 .github/workflows/custard-run-dev.yaml | 1 +
 .github/workflows/custard-run.yaml     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index caadc26661..182f112144 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -39,6 +39,7 @@ on:
   # schedule:
   #   # https://crontab.guru/#0_12_*_*_0
   #   - cron: 0 12 * * 0 # At 12:00 on Sunday
+  pull_request: # TODO: remove this
 
 jobs:
   affected:
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index e1a75d6439..ed0eee7b04 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -39,6 +39,7 @@ on:
   # schedule:
   #   # https://crontab.guru/#0_12_*_*_0
   #   - cron: 0 12 * * 0 # At 12:00 on Sunday
+  pull_request: # TODO: remove this
 
 jobs:
   affected:

From 75f7e7f82164c45ad5871f208506cd5276926b09 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 14:11:50 -0700
Subject: [PATCH 03/15] remove prod suffix

---
 .github/config/{nodejs-prod.jsonc => nodejs.jsonc} | 0
 .github/workflows/custard-ci.yaml                  | 4 ++--
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename .github/config/{nodejs-prod.jsonc => nodejs.jsonc} (100%)

diff --git a/.github/config/nodejs-prod.jsonc b/.github/config/nodejs.jsonc
similarity index 100%
rename from .github/config/nodejs-prod.jsonc
rename to .github/config/nodejs.jsonc
diff --git a/.github/workflows/custard-ci.yaml b/.github/workflows/custard-ci.yaml
index 4e509380a7..27ff2ed57e 100644
--- a/.github/workflows/custard-ci.yaml
+++ b/.github/workflows/custard-ci.yaml
@@ -57,9 +57,9 @@ jobs:
       - name: Find Node.js affected packages
         id: nodejs
         run: |
-          echo "paths=$(./cloud-samples-tools/bin/custard affected .github/config/nodejs-prod.jsonc diffs.txt paths.txt)" >> $GITHUB_OUTPUT
+          echo "paths=$(./cloud-samples-tools/bin/custard affected .github/config/nodejs.jsonc diffs.txt paths.txt)" >> $GITHUB_OUTPUT
           cat paths.txt
-          echo "setups=$(./cloud-samples-tools/bin/custard setup-files .github/config/nodejs-prod.jsonc paths.txt)" >> $GITHUB_OUTPUT
+          echo "setups=$(./cloud-samples-tools/bin/custard setup-files .github/config/nodejs.jsonc paths.txt)" >> $GITHUB_OUTPUT
 
   lint:
     needs: affected

From 5f8981edb6032417c9686bbc4f6ff2a8161db046 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 14:22:13 -0700
Subject: [PATCH 04/15] decode json on matrix paths

---
 .github/workflows/custard-run-dev.yaml | 2 +-
 .github/workflows/custard-run.yaml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index 182f112144..f01ae43c9d 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -61,7 +61,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        path: ${{ needs.affected.outputs.paths }}
+        path: ${{ fromJson(needs.affected.outputs.paths) }}
     continue-on-error: true
     env:
       GOOGLE_SAMPLES_PROJECT: long-door-651
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index ed0eee7b04..d529761e5e 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -100,7 +100,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        path: ${{ needs.affected.outputs.paths }}
+        path: ${{ fromJson(needs.affected.outputs.paths) }}
     continue-on-error: true
     env:
       GOOGLE_SAMPLES_PROJECT: long-door-651

From 946d1feea3fcdd413447648cdf539f76febe3747 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 14:26:47 -0700
Subject: [PATCH 05/15] add experimental to check names

---
 .github/workflows/custard-run-dev.yaml | 3 ++-
 .github/workflows/custard-run.yaml     | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index f01ae43c9d..66b29cb207 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -50,6 +50,7 @@ jobs:
       head-sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
       config-file: .github/config/nodejs-dev.jsonc
       paths: ${{ (inputs.run-all && '.') || inputs.paths || '' }}
+      check-name: Custard CI (dev / experimental)
       create-check-if: ${{ !!github.event.workflow_run }}
 
   test:
@@ -72,7 +73,7 @@ jobs:
         id: queued
         with:
           sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
-          name: Custard CI / ${{ github.job }} (${{ matrix.path }})
+          name: Custard CI (dev / experimental) / ${{ github.job }} (${{ matrix.path }})
           job-name: ${{ github.job }} (${{ matrix.path }})
           if: ${{ !!github.event.workflow_run }}
       - name: Setup Custard
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index d529761e5e..5e5875f15d 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -50,6 +50,7 @@ jobs:
       head-sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
       config-file: .github/config/nodejs.jsonc
       paths: ${{ (inputs.run-all && '.') || inputs.paths || '' }}
+      check-name: Custard CI (experimental)
       create-check-if: ${{ !!github.event.workflow_run }}
 
   lint:
@@ -65,7 +66,7 @@ jobs:
         with:
           sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
           status: in_progress
-          name: Custard CI / ${{ github.job }}
+          name: Custard CI (experimental) / ${{ github.job }}
           if: ${{ !!github.event.workflow_run }}
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -111,7 +112,7 @@ jobs:
         id: queued
         with:
           sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
-          name: Custard CI / ${{ github.job }} (${{ matrix.path }})
+          name: Custard CI (experimental) / ${{ github.job }} (${{ matrix.path }})
           job-name: ${{ github.job }} (${{ matrix.path }})
           if: ${{ !!github.event.workflow_run }}
       - name: Setup Custard

From fe5c4550cf559e7e2938da6fcc032891bd32aa74 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 14:27:38 -0700
Subject: [PATCH 06/15] add experimental to job names

---
 .github/workflows/custard-run-dev.yaml | 2 +-
 .github/workflows/custard-run.yaml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index 66b29cb207..aefebfb4da 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-name: Custard run (dev)
+name: Custard run (dev / experimental)
 
 on:
   push:
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index 5e5875f15d..bade5d31dc 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-name: Custard run
+name: Custard run (experimental)
 
 on:
   push:

From 4696f681b1d0bac0b1ffaea78d150e3ae334cbb5 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 14:31:14 -0700
Subject: [PATCH 07/15] run test only if paths is not empty

---
 .github/workflows/custard-run-dev.yaml | 3 ++-
 .github/workflows/custard-run.yaml     | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index aefebfb4da..b0c83288dd 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -54,6 +54,7 @@ jobs:
       create-check-if: ${{ !!github.event.workflow_run }}
 
   test:
+    if: needs.affected.outputs.paths
     needs: affected
     runs-on: ubuntu-latest
     timeout-minutes: 120 # 2 hours hard limit
@@ -62,7 +63,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        path: ${{ fromJson(needs.affected.outputs.paths) }}
+        path: ${{ needs.affected.outputs.paths }}
     continue-on-error: true
     env:
       GOOGLE_SAMPLES_PROJECT: long-door-651
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index bade5d31dc..588b893214 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -93,6 +93,7 @@ jobs:
           status: failure
 
   test:
+    if: needs.affected.outputs.paths
     needs: affected
     runs-on: ubuntu-latest
     timeout-minutes: 120 # 2 hours hard limit

From 67930c29ef29476b89478f870190b4c77671debb Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 14:32:28 -0700
Subject: [PATCH 08/15] test explicitly against empty array

---
 .github/workflows/custard-run-dev.yaml | 2 +-
 .github/workflows/custard-run.yaml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index b0c83288dd..d88ab898ec 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -54,7 +54,7 @@ jobs:
       create-check-if: ${{ !!github.event.workflow_run }}
 
   test:
-    if: needs.affected.outputs.paths
+    if: needs.affected.outputs.paths != '[]'
     needs: affected
     runs-on: ubuntu-latest
     timeout-minutes: 120 # 2 hours hard limit
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index 588b893214..8c7182c5b0 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -93,7 +93,7 @@ jobs:
           status: failure
 
   test:
-    if: needs.affected.outputs.paths
+    if: needs.affected.outputs.paths != '[]'
     needs: affected
     runs-on: ubuntu-latest
     timeout-minutes: 120 # 2 hours hard limit

From ba46775b821037b06f4557674c4f4f10842abaab Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 14:34:25 -0700
Subject: [PATCH 09/15] move experimental as a prefix

---
 .github/workflows/custard-run-dev.yaml | 6 +++---
 .github/workflows/custard-run.yaml     | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index d88ab898ec..54f2206169 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-name: Custard run (dev / experimental)
+name: (experimental / dev) Custard run
 
 on:
   push:
@@ -50,7 +50,7 @@ jobs:
       head-sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
       config-file: .github/config/nodejs-dev.jsonc
       paths: ${{ (inputs.run-all && '.') || inputs.paths || '' }}
-      check-name: Custard CI (dev / experimental)
+      check-name: (experimental / dev) Custard CI
       create-check-if: ${{ !!github.event.workflow_run }}
 
   test:
@@ -74,7 +74,7 @@ jobs:
         id: queued
         with:
           sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
-          name: Custard CI (dev / experimental) / ${{ github.job }} (${{ matrix.path }})
+          name: (experimental / dev) Custard CI / ${{ github.job }} (${{ matrix.path }})
           job-name: ${{ github.job }} (${{ matrix.path }})
           if: ${{ !!github.event.workflow_run }}
       - name: Setup Custard
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index 8c7182c5b0..51527c6388 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-name: Custard run (experimental)
+name: (experimental) Custard run
 
 on:
   push:
@@ -50,7 +50,7 @@ jobs:
       head-sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
       config-file: .github/config/nodejs.jsonc
       paths: ${{ (inputs.run-all && '.') || inputs.paths || '' }}
-      check-name: Custard CI (experimental)
+      check-name: (experimental) Custard CI
       create-check-if: ${{ !!github.event.workflow_run }}
 
   lint:
@@ -66,7 +66,7 @@ jobs:
         with:
           sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
           status: in_progress
-          name: Custard CI (experimental) / ${{ github.job }}
+          name: (experimental) Custard CI / ${{ github.job }}
           if: ${{ !!github.event.workflow_run }}
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -113,7 +113,7 @@ jobs:
         id: queued
         with:
           sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
-          name: Custard CI (experimental) / ${{ github.job }} (${{ matrix.path }})
+          name: (experimental) Custard CI / ${{ github.job }} (${{ matrix.path }})
           job-name: ${{ github.job }} (${{ matrix.path }})
           if: ${{ !!github.event.workflow_run }}
       - name: Setup Custard

From 9d50d40da30b48e5fc79273ac23de4ca211927bb Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 15:06:24 -0700
Subject: [PATCH 10/15] success check if no paths are found

---
 .github/workflows/custard-run-dev.yaml | 14 ++++++++++++++
 .github/workflows/custard-run.yaml     | 14 ++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index 54f2206169..f85ac79b63 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -125,3 +125,17 @@ jobs:
         with:
           check: ${{ needs.affected.outputs.check }}
           status: success
+
+  nothing-to-do:
+    if: needs.affected.outputs.paths != '[]'
+    needs: [affected]
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    steps:
+      - name: Check success
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        with:
+          check: ${{ needs.affected.outputs.check }}
+          status: success
+          title: Nothing to test
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index 51527c6388..4444a5d04a 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -164,3 +164,17 @@ jobs:
         with:
           check: ${{ needs.affected.outputs.check }}
           status: success
+
+  nothing-to-do:
+    if: needs.affected.outputs.paths != '[]'
+    needs: [affected]
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    steps:
+      - name: Check success
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        with:
+          check: ${{ needs.affected.outputs.check }}
+          status: success
+          title: Nothing to test

From 76bf58912358e74e942f5831cd338ed4588b0dc0 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 15:10:53 -0700
Subject: [PATCH 11/15] always set check to done

---
 .github/workflows/custard-run-dev.yaml | 15 +--------------
 .github/workflows/custard-run.yaml     | 15 +--------------
 2 files changed, 2 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index f85ac79b63..5b63d659df 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -119,23 +119,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       statuses: write
+    if: always()
     steps:
       - name: Check success
         uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
         with:
           check: ${{ needs.affected.outputs.check }}
           status: success
-
-  nothing-to-do:
-    if: needs.affected.outputs.paths != '[]'
-    needs: [affected]
-    runs-on: ubuntu-latest
-    permissions:
-      statuses: write
-    steps:
-      - name: Check success
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
-        with:
-          check: ${{ needs.affected.outputs.check }}
-          status: success
-          title: Nothing to test
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index 4444a5d04a..73659b3128 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -158,23 +158,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       statuses: write
+    if: always()
     steps:
       - name: Check success
         uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
         with:
           check: ${{ needs.affected.outputs.check }}
           status: success
-
-  nothing-to-do:
-    if: needs.affected.outputs.paths != '[]'
-    needs: [affected]
-    runs-on: ubuntu-latest
-    permissions:
-      statuses: write
-    steps:
-      - name: Check success
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
-        with:
-          check: ${{ needs.affected.outputs.check }}
-          status: success
-          title: Nothing to test

From 78c2f51f47f6b022d4eca1d372b74752240054d9 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Tue, 1 Apr 2025 15:14:59 -0700
Subject: [PATCH 12/15] remove pull_request trigger

---
 .github/workflows/custard-run-dev.yaml | 1 -
 .github/workflows/custard-run.yaml     | 1 -
 2 files changed, 2 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index 5b63d659df..fe0d68e592 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -39,7 +39,6 @@ on:
   # schedule:
   #   # https://crontab.guru/#0_12_*_*_0
   #   - cron: 0 12 * * 0 # At 12:00 on Sunday
-  pull_request: # TODO: remove this
 
 jobs:
   affected:
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index 73659b3128..fd645a355d 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -39,7 +39,6 @@ on:
   # schedule:
   #   # https://crontab.guru/#0_12_*_*_0
   #   - cron: 0 12 * * 0 # At 12:00 on Sunday
-  pull_request: # TODO: remove this
 
 jobs:
   affected:

From 46adf765867954453be932587f975eae53a54e0b Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Wed, 2 Apr 2025 11:17:51 -0700
Subject: [PATCH 13/15] rearrange if check

---
 .github/workflows/custard-run-dev.yaml | 2 +-
 .github/workflows/custard-run.yaml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index fe0d68e592..20dbb0c206 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -115,10 +115,10 @@ jobs:
 
   done:
     needs: [affected, test]
+    if: always()
     runs-on: ubuntu-latest
     permissions:
       statuses: write
-    if: always()
     steps:
       - name: Check success
         uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index fd645a355d..84c8ea4a99 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -154,10 +154,10 @@ jobs:
 
   done:
     needs: [affected, lint, test]
+    if: always()
     runs-on: ubuntu-latest
     permissions:
       statuses: write
-    if: always()
     steps:
       - name: Check success
         uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3

From 741774576a608aaa141a97f6f365e2794f71b617 Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Fri, 4 Apr 2025 12:56:21 -0700
Subject: [PATCH 14/15] add more comments

---
 .github/workflows/custard-run-dev.yaml | 15 +++++++++------
 .github/workflows/custard-run.yaml     | 14 +++++++++++---
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index 20dbb0c206..5955ff5372 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -15,14 +15,20 @@
 name: (experimental / dev) Custard run
 
 on:
-  push:
-    branches:
-      - main
+  # Run tests when a pull request is created or updated.
+  # This allows to run tests from forked repos (after reviewer's approval).
   workflow_run:
     workflows:
       - Custard CI # .github/workflows/custard-ci.yaml
     types:
       - in_progress
+
+  # Run tests again as validation when a PR merge into main.
+  push:
+    branches:
+      - main
+
+  # To do manual runs through the Actions UI.
   workflow_dispatch:
     inputs:
       run-all:
@@ -36,9 +42,6 @@ on:
         description: Branch, tag, or commit SHA to run tests on
         type: string
         default: main
-  # schedule:
-  #   # https://crontab.guru/#0_12_*_*_0
-  #   - cron: 0 12 * * 0 # At 12:00 on Sunday
 
 jobs:
   affected:
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index 84c8ea4a99..9e5a89f87c 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -15,14 +15,20 @@
 name: (experimental) Custard run
 
 on:
-  push:
-    branches:
-      - main
+  # Run tests when a pull request is created or updated.
+  # This allows to run tests from forked repos (after reviewer's approval).
   workflow_run:
     workflows:
       - Custard CI # .github/workflows/custard-ci.yaml
     types:
       - in_progress
+
+  # Run tests again as validation when a PR merge into main.
+  push:
+    branches:
+      - main
+
+  # To do manual runs through the Actions UI.
   workflow_dispatch:
     inputs:
       run-all:
@@ -36,6 +42,8 @@ on:
         description: Branch, tag, or commit SHA to run tests on
         type: string
         default: main
+
+  # For nightly tests.
   # schedule:
   #   # https://crontab.guru/#0_12_*_*_0
   #   - cron: 0 12 * * 0 # At 12:00 on Sunday

From 8f7bfb54146cded3ec4015a289138859b8a614ab Mon Sep 17 00:00:00 2001
From: David Cavazos <dcavazos@google.com>
Date: Fri, 4 Apr 2025 13:28:42 -0700
Subject: [PATCH 15/15] fix: add id-token to workflows

---
 .github/workflows/custard-run-dev.yaml | 8 +-------
 .github/workflows/custard-run.yaml     | 8 +-------
 2 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index 5955ff5372..24b8787235 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -61,6 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120 # 2 hours hard limit
     permissions:
+      id-token: write
       statuses: write
     strategy:
       fail-fast: false
@@ -108,13 +109,6 @@ jobs:
         with:
           check: ${{ steps.in_progress.outputs.check }}
           status: failure
-      # - name: Upload test results for FlakyBot workflow
-      #   if: github.event.action == 'schedule' && always() # always() submits logs even if tests fail
-      #   uses: actions/upload-artifact@v4
-      #   with:
-      #     name: test-results
-      #     path: ${{ matrix.path }}/${{ github.run_id }}_sponge_log.xml
-      #     retention-days: 1
 
   done:
     needs: [affected, test]
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index 9e5a89f87c..476a0d8020 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -105,6 +105,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120 # 2 hours hard limit
     permissions:
+      id-token: write
       statuses: write
     strategy:
       fail-fast: false
@@ -152,13 +153,6 @@ jobs:
         with:
           check: ${{ steps.in_progress.outputs.check }}
           status: failure
-      # - name: Upload test results for FlakyBot workflow
-      #   if: github.event.action == 'schedule' && always() # always() submits logs even if tests fail
-      #   uses: actions/upload-artifact@v4
-      #   with:
-      #     name: test-results
-      #     path: ${{ matrix.path }}/${{ github.run_id }}_sponge_log.xml
-      #     retention-days: 1
 
   done:
     needs: [affected, lint, test]