ci: use job summary instead of pr comment

.github/workflows/ci.yml

@@ -25,11 +25,21 @@ env:
   PACKAGE_BUILD: ${{ !github.event.pull_request.draft }}
   PACKAGE_UPLOAD: ${{ !github.event.pull_request.draft }}
 
-permissions:
-  pull-requests: write
-
 jobs:
-  setup:
+  # Quality gate to allow PR merge, used in the branch protection rules.
+  ci-passed:
+    runs-on: ubuntu-latest
+    needs: [lint-cmake, lint-clang, windows, macos, linux, unix]
+
+    steps:
+      - run: echo "CI passed" > $GITHUB_STEP_SUMMARY
+
+  # Summary of test results, combined from test result artifacts.
+  # Runs even if the tests fail to provide a summary of the failures.
+  test-results:
+    needs: [windows, macos, linux]
+    if: always()
+
     runs-on: ubuntu-latest
     timeout-minutes: 5
 
@@ -37,11 +47,32 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Test setup
-        uses: ./.github/actions/run-tests-setup
+      - name: Test summary
+        uses: ./.github/actions/test-summary
+
+  lint-cmake:
+    if: ${{ github.event_name == 'pull_request' }}
+    uses: ./.github/workflows/lint-cmake.yml
+
+  lint-clang:
+    if: ${{ github.event_name == 'pull_request' }}
+    uses: ./.github/workflows/lint-clang.yml
+
+  analyse-valgrind:
+    if: ${{ github.event_name == 'pull_request' }}
+    uses: ./.github/workflows/valgrind-analysis.yml
+
+  analyse-codeql:
+    if: ${{ github.event_name == 'pull_request' }}
+    uses: ./.github/workflows/codeql-analysis.yml
+
+  analyse-sonarcloud:
+    if: ${{ github.event_name == 'pull_request' }}
+    uses: ./.github/workflows/sonarcloud-analysis.yml
+    secrets:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
   windows:
-    needs: setup
     name: ${{ matrix.target.name }}
     runs-on: ${{ matrix.target.runs-on }}
     container: ${{ matrix.target.container }}
@@ -129,7 +160,6 @@ jobs:
           package-version: ${{ env.DESKFLOW_VERSION }}
 
   macos:
-    needs: setup
     name: ${{ matrix.target.name }}
     runs-on: ${{ matrix.target.os }}
     timeout-minutes: ${{ matrix.target.timeout }}
@@ -230,7 +260,7 @@ jobs:
           jq-filter: .distro |= map(select(.["runs-on"] | contains("arm64") | not))
 
   linux:
-    needs: [setup, linux-matrix]
+    needs: linux-matrix
     name: linux-${{ matrix.distro.name }}
     runs-on: ${{ matrix.distro.runs-on }}
     container: ${{ matrix.distro.container }}
@@ -294,7 +324,6 @@ jobs:
 
   # Technically, "unix" is a misnomer, but we use it here to mean "Unix-like BSD-derived".
   unix:
-    needs: setup
     name: unix-${{ matrix.distro.name }}
     runs-on: ${{ vars.CI_UNIX_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 20

.github/workflows/codeql-analysis.yml

@@ -2,12 +2,7 @@ name: "CodeQL Analysis"
 
 on:
   workflow_dispatch:
-  pull_request:
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - ready_for_review
+  workflow_call:
   push:
     branches: [master]
 

.github/workflows/lint-clang.yml

@@ -2,15 +2,7 @@ name: "Lint Clang"
 
 on:
   workflow_dispatch:
-  pull_request:
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - ready_for_review
-
-permissions:
-  pull-requests: write
+  workflow_call:
 
 jobs:
   lint-clang:
@@ -37,4 +29,3 @@ jobs:
         with:
           format-command: ./scripts/lint_clang.py -f
           format-tool: "clang-format"
-          comment-header: "lint-clang"

.github/workflows/lint-cmake.yml

@@ -2,15 +2,7 @@ name: "Lint CMake"
 
 on:
   workflow_dispatch:
-  pull_request:
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - ready_for_review
-
-permissions:
-  pull-requests: write
+  workflow_call:
 
 jobs:
   lint-cmake:
@@ -37,4 +29,3 @@ jobs:
         with:
           format-command: ./scripts/lint_cmake.py -f
           format-tool: "cmake-format"
-          comment-header: "lint-cmake"

.github/workflows/sonarcloud-analysis.yml

@@ -2,12 +2,10 @@ name: "SonarCloud Analysis"
 
 on:
   workflow_dispatch:
-  pull_request:
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - ready_for_review
+  workflow_call:
+    secrets:
+      SONAR_TOKEN:
+        required: true
   push:
     branches: [master]
 
@@ -78,7 +76,6 @@ jobs:
           QT_QPA_PLATFORM: offscreen
         run: cmake --build build --target coverage-unittests
 
-      # Retry integtests coverae as gcovr intermittently fails to parse .gcda files.
       - name: Integration tests coverage
         env:
           QT_QPA_PLATFORM: offscreen

.github/workflows/valgrind-analysis.yml

@@ -2,15 +2,7 @@ name: "Valgrind Analysis"
 
 on:
   workflow_dispatch:
-  pull_request:
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - ready_for_review
-
-permissions:
-  pull-requests: write
+  workflow_call:
 
 jobs:
   valgrind-analysis:
@@ -58,29 +50,22 @@ jobs:
         with:
           executable: ./build/bin/integtests
 
-      - name: Get workflow URL
-        id: workflow-url
+      - name: Set job summary
         run: |
-          repo_url="${{ github.server_url }}/${{ github.repository }}"
-          echo "url=$repo_url/actions/runs/${{ github.run_id }}" >> $GITHUB_OUTPUT
-        shell: bash
+          backticks='```'
+          message=$(cat <<EOF
+          ## Valgrind summary
 
-      - name: Append to PR comment
-        uses: marocchino/sticky-pull-request-comment@v2
-        if: github.event.pull_request.head.repo.full_name == github.repository
-        with:
-          recreate: true
-          header: valgrind
-          message: |
-            ## Valgrind summary
-            See [workflow run](${{ steps.workflow-url.outputs.url }}) for full `valgrind` output.
+          ### Unit tests
+          $backticks
+          ${{ steps.unittests.outputs.summary }}
+          $backticks
 
-            ### Unit tests
-            ```
-            ${{ steps.unittests.outputs.summary }}
-            ```
+          ### Integration tests
+          $backticks
+          ${{ steps.integtests.outputs.summary }}
+          $backticks
+          EOF
+          )
 
-            ### Integration tests
-            ```
-            ${{ steps.integtests.outputs.summary }}
-            ```
+          echo "$message" >> $GITHUB_STEP_SUMMARY