ci: fix workflow dependencies (#1659)

We want to run test.yaml and testinfra-ami-build.yaml after
nix-build.yaml. We start using reusable workflow instead of relying on
workflow_run which doesn't work well with pull requests.

Author: jfroche

.github/workflows/nix-build.yml

@@ -9,8 +9,10 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
   id-token: write
+  # required by testinfra-ami-build dependent workflows
+  contents: write
+  packages: write
 
 jobs:
   build-run-image:
@@ -84,3 +86,13 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY }}
           AWS_SESSION_TOKEN: ${{ env.AWS_SESSION_TOKEN }}
+  
+  run-testinfra:
+    needs: build-run-image
+    if: ${{ success() }}
+    uses: ./.github/workflows/testinfra-ami-build.yml
+    
+  run-tests:
+    needs: build-run-image
+    if: ${{ success() }}
+    uses: ./.github/workflows/test.yml

.github/workflows/test.yml

@@ -1,19 +1,14 @@
 name: Test Database
 on:
-  # Trigger this workflow when the "Nix CI" workflow completes
-  workflow_run:
-    workflows: ["Nix CI"]
-    types:
-      - completed
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
   id-token: write
 
 jobs:
   prepare:
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
@@ -31,7 +26,6 @@ jobs:
           VERSIONS=$(nix run nixpkgs#yq -- '.postgres_major[]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c "split(\"\n\")[:-1]")
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
   build:
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     needs: prepare
     strategy:
       matrix:

.github/workflows/testinfra-ami-build.yml

@@ -1,20 +1,15 @@
 name: Testinfra Integration Tests Nix
 
 on:
-  # Trigger this workflow when the "Nix CI" workflow completes
-  workflow_run:
-    workflows: ["Nix CI"]
-    types:
-      - completed
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
   id-token: write
 
 jobs:
   prepare:
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
@@ -31,7 +26,6 @@ jobs:
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
 
   test-ami-nix:
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     needs: prepare
     strategy:
       fail-fast: false