[build] unlock trunk once the release finishes writing to it

.github/rulesets/release-require-passing.json

@@ -37,5 +37,11 @@
       }
     }
   ],
-  "bypass_actors": []
+  "bypass_actors": [
+    {
+      "actor_id": 19032128,
+      "actor_type": "Team",
+      "bypass_mode": "always"
+    }
+  ]
 }

.github/rulesets/release-restrict-trunk.json

@@ -23,6 +23,11 @@
       "actor_id": 7157452,
       "actor_type": "Team",
       "bypass_mode": "always"
+    },
+    {
+      "actor_id": 19032128,
+      "actor_type": "Team",
+      "bypass_mode": "always"
     }
   ]
 }

.github/workflows/commit-changes.yml

@@ -48,6 +48,10 @@ jobs:
           git config --local user.email "selenium-ci@users.noreply.github.com"
           git config --local user.name "Selenium CI Bot"
           if [ -s changes.patch ]; then
+            if git apply --reverse --check changes.patch 2>/dev/null; then
+              echo "::notice::Patch already applied on this branch; skipping commit and push."
+              exit 0
+            fi
             git apply --index changes.patch
             rm -f changes.patch
             git commit -m "$COMMIT_MESSAGE"

.github/workflows/nightly.yml

@@ -80,7 +80,7 @@ jobs:
   release-grid:
     name: Release Grid
     needs: [prepare, nightly-release]
-    if: always() && needs.prepare.outputs.artifact-name
+    if: always() && needs.prepare.outputs.artifact-name && needs.nightly-release.result != 'skipped'
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/release.yml

@@ -261,25 +261,23 @@ jobs:
 
   verify:
     name: Verify Published Packages
-    needs: [parse-tag, docs]
+    needs: [parse-tag, publish, publish-python]
+    if: >-
+      always() && !cancelled() &&
+      needs.publish.result == 'success' &&
+      (needs.publish-python.result == 'success' || needs.publish-python.result == 'skipped')
     uses: ./.github/workflows/bazel.yml
     with:
       name: Verify packages
       run: ./go ${{ needs.parse-tag.outputs.language }}:verify
 
-  unrestrict-trunk:
-    name: Unrestrict Trunk Branch
-    needs: verify
-    uses: ./.github/workflows/restrict-trunk.yml
-    with:
-      restrict: false
-    secrets:
-      SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-
   reset-version:
     name: Generate Nightly Versions
-    needs: [parse-tag, docs]
+    needs: [parse-tag, publish, publish-python]
+    if: >-
+      always() && !cancelled() &&
+      needs.publish.result == 'success' &&
+      (needs.publish-python.result == 'success' || needs.publish-python.result == 'skipped')
     uses: ./.github/workflows/bazel.yml
     with:
       name: Reset Versions
@@ -288,7 +286,7 @@ jobs:
 
   update-version:
     name: Push Nightly Versions
-    needs: [parse-tag, reset-version, unrestrict-trunk]
+    needs: [parse-tag, reset-version]
     permissions:
       contents: write
       actions: read
@@ -301,7 +299,7 @@ jobs:
 
   nightly:
     name: Publish Nightly Packages
-    needs: [parse-tag, update-version]
+    needs: [parse-tag, unrestrict-trunk]
     permissions:
       contents: write
       packages: write
@@ -312,26 +310,42 @@ jobs:
 
   mirror:
     name: Update Release Mirror
-    needs: [parse-tag, nightly]
+    needs: [parse-tag, update-version]
     if: needs.parse-tag.outputs.language == 'all'
     uses: ./.github/workflows/mirror-selenium-releases.yml
     secrets: inherit
 
-  on-release-failure:
-    name: On Release Failure
+  unrestrict-trunk:
+    name: Unrestrict Trunk Branch
+    needs: [parse-tag, publish, publish-python, update-version, mirror]
+    if: >-
+      always() && !cancelled() &&
+      needs.publish.result == 'success' &&
+      (needs.publish-python.result == 'success' || needs.publish-python.result == 'skipped') &&
+      needs.update-version.result == 'success' &&
+      (needs.mirror.result == 'success' || needs.mirror.result == 'skipped')
+    uses: ./.github/workflows/restrict-trunk.yml
+    with:
+      restrict: false
+    secrets:
+      SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+
+  on-release-complete:
+    name: On Release Complete
     runs-on: ubuntu-latest
-    needs: [publish, publish-python, docs, create-tag, github-release-draft, github-release-publish, update-version, nightly, mirror, verify]
-    if: failure()
+    needs: [publish, publish-python, docs, create-tag, github-release-draft, github-release-publish, reset-version, update-version, nightly, mirror, verify, unrestrict-trunk]
+    if: always() && !cancelled()
     steps:
       - uses: actions/checkout@v6
       - name: Slack Notification
         uses: rtCamp/action-slack-notify@v2
         env:
-          SLACK_ICON_EMOJI: ":rotating_light:"
-          SLACK_COLOR: failure
+          SLACK_ICON_EMOJI: ${{ contains(needs.*.result, 'failure') && ':rotating_light:' || (needs.publish.result == 'success' && ':white_check_mark:' || ':warning:') }}
+          SLACK_COLOR: ${{ contains(needs.*.result, 'failure') && 'failure' || (needs.publish.result == 'success' && 'good' || 'warning') }}
           SLACK_CHANNEL: selenium-tlc
           SLACK_USERNAME: GitHub Workflows
-          SLACK_TITLE: Release failed
+          SLACK_TITLE: ${{ contains(needs.*.result, 'failure') && 'Release failed' || (needs.publish.result == 'success' && 'Release complete' || 'Release did not run') }}
           SLACK_MESSAGE: |
             • Selenium Published: ${{ needs.publish.result }}
             • Python Published: ${{ needs.publish-python.result }}
@@ -343,5 +357,6 @@ jobs:
             • Nightly Packages: ${{ needs.nightly.result }}
             • Mirror Updated: ${{ needs.mirror.result }}
             • Packages Verified: ${{ needs.verify.result }}
+            • Trunk Unlocked: ${{ needs.unrestrict-trunk.result }}
           MSG_MINIMAL: actions url
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}