ci: Improve release workflows (apify#638)

- closes apify#469 
- closes apify#706

.github/workflows/build_and_deploy_docs.yaml

@@ -1,10 +1,12 @@
 name: Build and deploy docs
 
 on:
-  push:
-    branches:
-      - master
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
 
 env:
   NODE_VERSION: 20
@@ -25,6 +27,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
+          ref: ${{ github.event_name == 'workflow_call' && inputs.ref || github.ref }}
 
       - name: Set up Node
         uses: actions/setup-node@v4

.github/workflows/pre_release.yaml

@@ -8,6 +8,10 @@ on:
     tags-ignore:
       - "**" # Ignore all tags to prevent duplicate builds when tags are pushed.
 
+concurrency: 
+  group: release
+  cancel-in-progress: false
+
 jobs:
   release_metadata:
     if: "!startsWith(github.event.head_commit.message, 'docs') && !startsWith(github.event.head_commit.message, 'ci') && startsWith(github.repository, 'apify/')"
@@ -24,28 +28,35 @@ jobs:
         with:
           release_type: prerelease
 
-  lint_check:
-    name: Lint check
-    uses: apify/workflows/.github/workflows/python_lint_check.yaml@main
-
-  type_check:
-    name: Type check
-    uses: apify/workflows/.github/workflows/python_type_check.yaml@main
-
-  unit_tests:
-    name: Unit tests
-    uses: apify/workflows/.github/workflows/python_unit_tests.yaml@main
+  # If github.ref points to a [ci skip] commit, this workflow won't run.
+  # Otherwise, these checks will be launched from the `run_code_checks` workflow.
+  wait_for_checks:
+    name: Wait for code checks to pass
+    runs-on: ubuntu-latest
+    steps:
+      - uses: lewagon/[email protected]
+        with:
+          ref: ${{ github.ref }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          check-regexp: "( check| tests)$"
+          wait-interval: 5
 
   update_changelog:
     name: Update changelog
-    needs: [release_metadata, lint_check, type_check, unit_tests]
+    needs: [release_metadata, wait_for_checks]
     uses: apify/workflows/.github/workflows/python_bump_and_update_changelog.yaml@main
     with:
       version_number: ${{ needs.release_metadata.outputs.version_number }}
       changelog: ${{ needs.release_metadata.outputs.changelog }}
     secrets:
       APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
 
+  build_and_deploy_docs:
+    needs: [update_changelog]
+    uses: ./.github/workflows/build_and_deploy_docs.yaml
+    with:
+      ref: ${{ needs.update_changelog.outputs.changelog_commitish }}
+
   publish_to_pypi:
     name: Publish to PyPI
     needs: [release_metadata, update_changelog]

.github/workflows/release.yaml

@@ -21,6 +21,10 @@ on:
         type: string
         default: ""
 
+concurrency: 
+  group: release
+  cancel-in-progress: false
+
 jobs:
   release_metadata:
     name: Prepare release metadata
@@ -38,17 +42,19 @@ jobs:
           release_type: ${{ inputs.release_type }}
           custom_version: ${{ inputs.custom_version }}
 
-  lint_check:
-    name: Lint check
-    uses: apify/workflows/.github/workflows/python_lint_check.yaml@main
-
-  type_check:
-    name: Type check
-    uses: apify/workflows/.github/workflows/python_type_check.yaml@main
-
-  unit_tests:
-    name: Unit tests
-    uses: apify/workflows/.github/workflows/python_unit_tests.yaml@main
+  # If github.ref points to a [ci skip] commit, we assume that it was added by the pre_release workflow, 
+  # which doesn't push the commit if code checks don't pass.
+  # Otherwise, the checks will have been triggered by the `run_code_checks` workflow.
+  wait_for_checks:
+    name: Wait for code checks to pass
+    runs-on: ubuntu-latest
+    steps:
+      - uses: lewagon/[email protected]
+        with:
+          ref: ${{ github.ref }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          check-regexp: "( check| tests)$"
+          wait-interval: 5
 
   update_changelog:
     name: Update changelog
@@ -60,6 +66,12 @@ jobs:
     secrets:
       APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
 
+  build_and_deploy_docs:
+    needs: [update_changelog]
+    uses: ./.github/workflows/build_and_deploy_docs.yaml
+    with:
+      ref: ${{ needs.update_changelog.outputs.changelog_commitish }}
+
   create_github_release:
     name: Create github release
     needs: [release_metadata, update_changelog]

.github/workflows/run_code_checks.yaml

@@ -6,6 +6,16 @@ on:
   # step required for PRs from forks. This prevents their potential exposure.
   pull_request:
 
+  # Pushing to the master branch triggers code checks
+  push:
+    branches:
+      - master
+    tags-ignore:
+      - "**" # Ignore all tags to prevent duplicate checks when tags are pushed.
+
+  # It should also be possible to trigger checks manually
+  workflow_dispatch:
+
 jobs:
   lint_check:
     name: Lint check
@@ -19,7 +29,7 @@ jobs:
     name: Unit tests
     uses: apify/workflows/.github/workflows/python_unit_tests.yaml@main
     secrets:
-      httpbin_url: https://janbuchar--httpbin.apify.actor?token=${{ secrets.APIFY_HTTPBIN_TOKEN }}
+      httpbin_url: ${{ secrets.APIFY_HTTPBIN_TOKEN && format('https://janbuchar--httpbin.apify.actor?token={0}', secrets.APIFY_HTTPBIN_TOKEN) || 'https://httpbin.org'}}
 
   docs_check:
     name: Docs check