Update GHA tests to return single pass/fail signal at the end

Before this PR, we stored a list internally of tests that must pass on presubmit and tried to keep it up to date.

This PR moves that information keeping into GitHub by adding a 'continuous-only' variable to most testing matrices to allow authors to specify which of their tests should be skipped on presubmit. During presubmit, tests that were specified to not run on presubmit will not be run and their names will be prefixed with "[SKIPPED]". All continuous only tests will be suffixed with "(Continuous)".

At the end of running all the tests, we have a single "All Blocking Tests" signal that will tell us whether all of the necessary tests have passed (either for presubmit or continuous based on how the test was triggered).

I've tested this from a different branch [here](https://github.com/protocolbuffers/protobuf/actions/runs/9602443750?pr=17151) and from a different fork [here](https://github.com/protocolbuffers/protobuf/actions/runs/9602554500?pr=17192). These should be the same and are as far as I can tell.

I also have a continuous test run [here](https://github.com/protocolbuffers/protobuf/actions/runs/9603824200) which runs the entire test suite.

Closes #17198

PiperOrigin-RevId: 659994321

.github/scripts/validate_yaml.py

@@ -0,0 +1,58 @@
+"""Validate the YAML files for GitHub Actions workflows."""
+
+import os
+
+import yaml
+
+# Ensure every job is in the list of blocking jobs.
+with open(
+    os.path.join(os.path.dirname(__file__), '../workflows/test_runner.yml'), 'r'
+) as f:
+  data = yaml.safe_load(f)
+
+  all_jobs = data['jobs'].keys()
+  blocking_jobs = data['jobs']['all_blocking_tests']['needs']
+  for job in all_jobs:
+    if job != 'all_blocking_tests':
+      if job not in blocking_jobs:
+        raise ValueError(
+            'Job %s is not in the list of blocking jobs.'
+            % (job)
+        )
+
+# Ensure every job with a continuous prefix conditions every step on whether we
+# are in a continuous run.
+for root, dirs, files in os.walk(
+    os.path.join(os.path.dirname(__file__), '../workflows')
+):
+  for file in files:
+    if file.endswith('.yml'):
+      with open(os.path.join(root, file), 'r') as f:
+        data = yaml.safe_load(f)
+        if 'jobs' not in data:
+          continue
+        jobs = data['jobs']
+        for job in jobs:
+          if 'steps' not in jobs[job]:
+            continue
+          continuous_condition = 'inputs.continuous-prefix' in jobs[job]['name']
+          steps = jobs[job]['steps']
+          for step in steps:
+            if 'if' in step:
+              if continuous_condition:
+                if 'continuous-run' not in step['if']:
+                  raise ValueError(
+                      'Step %s in job %s does not check the continuous-run '
+                      'condition' % (step['name'], job)
+                  )
+              elif 'continuous-run' in step['if']:
+                raise ValueError(
+                    'Step %s in job %s checks the continuous-run condition but '
+                    'the job does not contain the continuous-prefix'
+                    % (step['name'], job)
+                )
+            elif continuous_condition:
+              raise ValueError(
+                  'Step %s in job %s does not check the continuous-run '
+                  'condition' % (step['name'], job)
+              )

.github/workflows/staleness_check.yml

@@ -6,6 +6,11 @@ on:
     - cron: 0 10 * * *
   workflow_call:
     inputs:
+      continuous-run:
+        required: true
+        description: "Boolean string denoting whether this run is continuous --
+          empty string for presubmit, non-empty string for continuous."
+        type: string
       safe-checkout:
         required: false
         description: "The SHA key for the commit we want to run over"
@@ -20,6 +25,11 @@ jobs:
       matrix:
         branch: [main, 25.x, 27.x, 28.x]
         os: [{ name: Linux, value: ubuntu-latest}]
+        exclude:
+          # If we are in a presubmit run, only test main
+          - branch: ${{ !inputs.continuous-run && '25.x' }}
+          - branch: ${{ !inputs.continuous-run && '27.x' }}
+          - branch: ${{ !inputs.continuous-run && '28.x' }}
 
     name: Test staleness ${{ matrix.os.name }} ${{ github.head_ref && 'PR' || matrix.branch }}
     runs-on: ${{ matrix.os.value }}

.github/workflows/test_bazel.yml

@@ -3,10 +3,19 @@ name: Bazel Tests
 on:
   workflow_call:
     inputs:
+      continuous-run:
+        required: true
+        description: "Boolean string denoting whether this run is continuous --
+          empty string for presubmit, non-empty string for continuous."
+        type: string
       safe-checkout:
         required: true
         description: "The SHA key for the commit we want to run over"
         type: string
+      continuous-prefix:
+        required: true
+        description: "The prefix for tests that should only be run continuously"
+        type: string
 
 permissions:
   contents: read
@@ -24,26 +33,30 @@ jobs:
             bazelversion: '6.4.0'
             # Not running Bazel 6 with bzlmod, because it doesn't support use_repo_rule in rules_jvm_external
             bzlmod: false
+            continuous-only: true
     runs-on: ${{ matrix.runner }}-latest
-    name: Examples ${{ matrix.runner }} ${{ matrix.bazelversion }}${{ matrix.bzlmod && ' (bzlmod)' || '' }}
+    name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Examples ${{ matrix.runner }} ${{ matrix.bazelversion }}${{ matrix.bzlmod && ' (bzlmod)' || '' }}
     steps:
       - name: Checkout pending changes
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/checkout@v3
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Windows startup flags
-        if: runner.os == 'Windows'
+        if: ${{ runner.os == 'Windows' && (!matrix.continuous-only || inputs.continuous-run) }}
         working-directory: examples
         shell: bash
         run: echo "startup --output_user_root=C:/ --windows_enable_symlinks" >> .bazelrc
 
       - name: Configure Bazel version
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         working-directory: examples
         shell: bash
         run: echo "${{ matrix.bazelversion }}" > .bazelversion
 
       - name: Run tests
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/bazel@v3
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}