ci: post PR-open skip check inline for internal PRs (fix waiting-for-status hang)

Follow-up to the previous commit. Removing the inline PR-open poster in favour
of the workflow_run reporter created a bootstrap gap: workflow_run workflows
only run from the DEFAULT-branch copy, so on this PR (and any introducing PR)
the reporter can't fire and NOTHING posts 'Python Integration Tests' on the PR
head — the required check sits 'Expected — Waiting for status to be reported'
forever.

Fix: split the placeholder by PR origin, both posting as the driver-test app
(the identity the ruleset pins the required check to):

- Internal PRs: restore skip-integration-tests-pr in trigger-integration-tests.yml,
  now minting the INTEGRATION_TEST_APP token (not github.token) and self-guarded
  to head repo == base repo. Posts from the PR branch immediately — no label, no
  workflow_run dependency. This is what unblocks internal PRs like this one.
- Fork PRs: skip-checks-reporter.yml (workflow_run) now self-guards to fork runs
  (head repo != base repo), since a fork's pull_request run can't mint secrets
  inline. The two guards are mutually exclusive — no double-post.

Behaviour matches the intent: skipped placeholder on PR open, real run in the
merge queue (and label preview). The merge-queue app-token posts from the prior
commit are unchanged.

Co-authored-by: Isaac

Author: eric-wang-1990

.github/workflows/skip-checks-reporter.yml

@@ -1,21 +1,24 @@
 name: Report Integration Test Skip
 
 # Posts the PR-open "skipped" placeholder for the required
-# `Python Integration Tests` check, as the driver-test GitHub App.
+# `Python Integration Tests` check on FORK PRs, as the driver-test GitHub App.
 #
-# Why a separate workflow (and not an inline job in trigger-integration-tests.yml):
-#   - The branch ruleset pins the required `Python Integration Tests` check to the
-#     driver-test app's integration id (driver-integration-test). Only a check
-#     posted BY that app satisfies the gate — a `github.token` (github-actions)
-#     check of the same name does NOT (it is a different check context).
-#   - A PR from a fork runs its `pull_request` workflows with a READ-ONLY GITHUB_TOKEN
-#     and no access to secrets, so it cannot mint the app token and cannot post any
-#     check on its own head. That would leave fork PRs unable to enter the merge queue
-#     without a maintainer label.
-#   - `workflow_run` workflows always execute in THIS (base) repo's context using the
-#     workflow definition from the default branch, with full secret access — even when
-#     the run that triggered them came from a fork. That lets us post the app-attributed
-#     placeholder on any PR head, fork or not, so every PR can auto-enqueue.
+# Division of labour:
+#   - INTERNAL PRs: the placeholder is posted inline by trigger-integration-tests.yml's
+#     `skip-integration-tests-pr` job (it can mint the app token directly). Posting it
+#     there means it works from the PR branch immediately, without waiting for this
+#     workflow_run file to reach the default branch.
+#   - FORK PRs: a fork's `pull_request` run has a READ-ONLY GITHUB_TOKEN and no secrets,
+#     so it cannot mint the app token or post any check on its own head. This
+#     workflow_run workflow instead runs in THIS (base) repo's context with full secret
+#     access even for fork-triggered runs, so it can post the app-attributed placeholder
+#     on a fork PR's head. This job self-guards to fork runs to avoid double-posting on
+#     internal PRs (which the inline job already covers).
+#
+# Why the app (not github.token): the ruleset pins the required
+# `Python Integration Tests` check to the driver-test app's integration id. Only a
+# check posted BY that app satisfies the gate — a github.token (github-actions) check
+# of the same name is a different context and does NOT.
 #
 # SECURITY: this workflow runs with secrets in a privileged context. It MUST NOT check
 # out or execute any PR/fork-controlled content. It only calls checks.create with a
@@ -25,8 +28,7 @@ name: Report Integration Test Skip
 #
 # The real integration suite is unaffected: it runs as the required gate on the
 # `merge_group` commit (and as a label preview on internal PRs), dispatched by
-# trigger-integration-tests.yml. This workflow only posts the pre-merge placeholder.
-# Mirrors databricks-sql-go / databricks-sql-nodejs.
+# trigger-integration-tests.yml. Mirrors databricks-sql-go / databricks-sql-nodejs.
 
 on:
   workflow_run:
@@ -35,8 +37,11 @@ on:
 
 jobs:
   report-skip:
-    # Only for PR-triggered runs; the merge_group run posts the real required check.
-    if: github.event.workflow_run.event == 'pull_request'
+    # Fork PR-triggered runs only. Internal PRs are posted inline by
+    # trigger-integration-tests.yml; the merge_group run posts the real required check.
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name
     runs-on:
       group: databricks-protected-runner-group
       labels: linux-ubuntu-latest
@@ -45,22 +50,14 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      # The reporter triggers on EVERY pull_request run of "Trigger Integration
-      # Tests" (opened/synchronize/reopened/labeled/closed), but the
-      # workflow_run payload does NOT expose the originating sub-action, so we
-      # cannot filter on it directly. Recover the needed context from the PR
-      # and post the synthetic success only for the opened/synchronize/reopened
-      # scope the old inline job covered:
-      #   - skip when the PR is closed (outside the old job's scope), and
-      #   - skip when a real label preview is running for this head (an internal
-      #     PR carrying the integration-test label): trigger-tests-pr dispatches
-      #     the real suite and driver-test posts the real check for the same
-      #     app + name + head_sha, so a premature success placeholder would race
-      #     that check and could mask a real preview failure.
-      # Fork PRs KEEP the placeholder even when labeled: their label preview
-      # cannot dispatch (no secret access), so nothing else posts the required
-      # check for them. This is a read-only lookup (no checkout / no execution
-      # of PR-controlled content) and does not weaken the SECURITY note above.
+      # This job is fork-only (see the job `if:`), so the placeholder is always
+      # appropriate EXCEPT when the fork PR is already closed. A fork PR's label
+      # preview cannot dispatch the real suite (no secret access), so nothing
+      # else posts the required check for it — keep the placeholder even when
+      # labeled. Skip only closed PRs. Resolve the PR by SHA because a fork's
+      # workflow_run payload has an empty pull_requests array. Read-only lookup
+      # (no checkout / no execution of PR content) — does not weaken the SECURITY
+      # note above.
       - name: Decide whether to post the placeholder
         id: gate
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
@@ -90,12 +87,9 @@ jobs:
               repo: context.repo.repo,
               pull_number: number,
             });
-            const isFork = pr.head.repo.full_name !== `${context.repo.owner}/${context.repo.repo}`;
-            const hasLabel = pr.labels.some(l => l.name === 'integration-test');
             const isClosed = pr.state === 'closed';
-            const skip = isClosed || (hasLabel && !isFork);
-            console.log(`PR #${number} fork=${isFork} label=${hasLabel} closed=${isClosed} -> post=${!skip}`);
-            core.setOutput('post', (!skip).toString());
+            console.log(`PR #${number} closed=${isClosed} -> post=${!isClosed}`);
+            core.setOutput('post', (!isClosed).toString());
 
       - name: Generate GitHub App token (this repo)
         id: app-token

.github/workflows/trigger-integration-tests.yml

@@ -116,16 +116,61 @@ jobs:
               body: body
             });
 
-  # NOTE: the PR-open "skipped" placeholder for the required
-  # `Python Integration Tests` check is NOT posted here. It is posted by the
-  # companion workflow `skip-checks-reporter.yml`, which runs on `workflow_run`
-  # in the base-repo context so it can post the check as the driver-test app —
-  # the app the branch ruleset PINS the required check to — on EVERY PR head,
-  # including fork PRs (whose own `pull_request` run gets a read-only token and
-  # cannot post checks at all). A `pull_request`-triggered `github.token` stub
-  # here posted the check as `github-actions`, which is a DIFFERENT check
-  # context and did NOT satisfy the app-pinned gate — so the required check sat
-  # unfulfilled and PRs stayed blocked. See skip-checks-reporter.yml.
+  # =============================================================================
+  # For internal PRs: post the "skipped" placeholder for the required
+  # `Python Integration Tests` check on non-label events. The real run happens in
+  # the merge queue (or via explicit label preview).
+  #
+  # CRITICAL: post as the driver-test APP, not github.token. The ruleset pins the
+  # required check to that app's integration id; a github.token (github-actions)
+  # check of the same name is a DIFFERENT context and does NOT satisfy the gate,
+  # so the required check would sit "waiting for status" forever.
+  #
+  # Fork PRs are handled by the companion `skip-checks-reporter.yml` (workflow_run):
+  # a fork's `pull_request` run has a read-only token and no secrets, so it can
+  # neither mint the app token nor post any check here. This job self-guards to
+  # internal PRs (head repo == base repo); the reporter covers forks from the
+  # base-repo context. Internal PRs are posted HERE (not via the reporter) so the
+  # placeholder appears without depending on the workflow_run copy being on the
+  # default branch.
+  # =============================================================================
+  skip-integration-tests-pr:
+    if: |
+      github.event_name == 'pull_request' &&
+      github.event.action != 'labeled' &&
+      github.event.action != 'closed' &&
+      github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+    steps:
+      - name: Generate GitHub App token (this repo)
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        with:
+          app-id: ${{ secrets.INTEGRATION_TEST_APP_ID }}
+          private-key: ${{ secrets.INTEGRATION_TEST_PRIVATE_KEY }}
+          owner: databricks
+          repositories: databricks-sql-python
+
+      - name: Skip Python Integration Tests
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            await github.rest.checks.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: 'Python Integration Tests',
+              head_sha: context.payload.pull_request.head.sha,
+              status: 'completed',
+              conclusion: 'success',
+              completed_at: new Date().toISOString(),
+              output: {
+                title: 'Skipped on PR — runs in merge queue',
+                summary: 'Python Integration Tests are skipped on PRs and run as the required gate in the merge queue. Add the `integration-test` label to preview them on this PR.'
+              }
+            });
 
   # =============================================================================
   # For PRs: Dispatch real tests when integration-test label is added.