chore: run CI on contributor forks

.github/workflows/build_and_test.yml

@@ -0,0 +1,38 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Reusable workflow invoked by build_main.yml. Modelled on Apache Spark's
+# build_and_test.yml: the heavy work runs wherever the calling push lands,
+# i.e. on the contributor's fork. Delegates the test matrix to the umbrella
+# ci.yml workflow, which fans out to the per-Spark-version reusables.
+
+name: Build and test
+
+on:
+  workflow_call:
+
+jobs:
+  ci:
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    with:
+      # Force every gated job to run on fork-CI: contributor pushes don't necessarily
+      # touch paths that match ci.yml's filters (e.g. when iterating on the fork-CI
+      # workflow files themselves), so honour the Spark-style "run the full matrix"
+      # contract instead of skipping silently.
+      force_all: true

.github/workflows/build_main.yml

@@ -0,0 +1,35 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Modelled on Apache Spark's build_main.yml. Triggers on push to any branch,
+# which means contributor pushes to a fork run CI on the fork's Actions
+# minutes/runners rather than on apache/datafusion-comet. The bridge to the
+# upstream PR check is notify_test_workflow.yml.
+
+name: "Build"
+
+on:
+  push:
+    branches:
+    - '**'
+
+jobs:
+  call-build-and-test:
+    permissions:
+      packages: write
+    name: Run
+    uses: ./.github/workflows/build_and_test.yml

.github/workflows/ci.yml

@@ -22,16 +22,30 @@
 name: CI
 
 concurrency:
-  group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
+  # Use github.ref (branch ref) instead of github.sha for the push-event fallback
+  # so consecutive pushes to the same branch cancel each other; sha would make
+  # every push a new group and stack runs up.
+  group: ${{ github.repository }}-${{ github.head_ref || github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+# CI DISABLED 2026-05-31 — auto-triggers commented out. Active triggers:
+#   * workflow_dispatch — manual runs
+#   * workflow_call     — invoked by build_and_test.yml on contributor forks
+# To rollback: restore the commented `pull_request` and `push` blocks below.
 on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches:
-      - main
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      force_all:
+        description: 'Force-enable every gated job (used by fork-CI so the full matrix runs regardless of which paths changed).'
+        required: false
+        type: boolean
+        default: false
+  # pull_request:
+  #   types: [opened, synchronize, reopened, labeled]
+  # push:
+  #   branches:
+  #     - main
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -43,7 +57,7 @@ jobs:
   # ---------------------------------------------------------------------------
   preflight:
     name: Preflight
-    runs-on: ubuntu-slim
+    runs-on: ${{ github.repository == 'apache/datafusion-comet' && 'ubuntu-slim' || 'ubuntu-24.04' }}
     steps:
       - uses: actions/checkout@v6
 
@@ -89,7 +103,7 @@ jobs:
   changes:
     name: Detect changes
     needs: preflight
-    runs-on: ubuntu-slim
+    runs-on: ${{ github.repository == 'apache/datafusion-comet' && 'ubuntu-slim' || 'ubuntu-24.04' }}
     outputs:
       build_linux:  ${{ steps.compute.outputs.build_linux }}
       build_macos:  ${{ steps.compute.outputs.build_macos }}
@@ -118,9 +132,10 @@ jobs:
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PUSH_BEFORE: ${{ github.event.before }}
           PUSH_AFTER:  ${{ github.sha }}
+          FORCE_ALL:   ${{ inputs.force_all }}
         run: |
           set -euo pipefail
-          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
+          if [[ "$EVENT_NAME" == "workflow_dispatch" || "$FORCE_ALL" == "true" ]]; then
             for key in build_linux build_macos benchmark docs spark_3_4 spark_3_5 spark_4_0 spark_4_1 iceberg_1_8 iceberg_1_9 iceberg_1_10; do
               echo "${key}=true" >> "$GITHUB_OUTPUT"
             done

.github/workflows/codeql.yml

@@ -22,13 +22,16 @@ concurrency:
   group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
   cancel-in-progress: true
 
+# CI DISABLED 2026-05-31 — auto-triggers commented out, only manual workflow_dispatch remains.
+# To rollback: remove `workflow_dispatch:` and restore the commented `push`/`pull_request`/`schedule` blocks below.
 on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '16 4 * * 1'
+  workflow_dispatch:
+  # push:
+  #   branches: [ "main" ]
+  # pull_request:
+  #   branches: [ "main" ]
+  # schedule:
+  #   - cron: '16 4 * * 1'
 
 permissions:
   contents: read

.github/workflows/label_new_issues.yml

@@ -17,9 +17,12 @@
 
 name: Label new issues with requires-triage
 
+# CI DISABLED 2026-05-31 — auto-trigger commented out, only manual workflow_dispatch remains.
+# To rollback: remove `workflow_dispatch:` and restore the commented `issues` block below.
 on:
-  issues:
-    types: [opened]
+  workflow_dispatch:
+  # issues:
+  #   types: [opened]
 
 permissions:
   issues: write

.github/workflows/miri.yml

@@ -21,10 +21,12 @@ concurrency:
   group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
   cancel-in-progress: true
 
+# CI DISABLED 2026-05-31 — nightly schedule commented out, only manual workflow_dispatch remains.
+# To rollback: restore the commented `schedule` block below.
 on:
   # nightly safety check
-  schedule:
-    - cron: '0 4 * * *'
+  # schedule:
+  #   - cron: '0 4 * * *'
   # manual trigger
   # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   workflow_dispatch:

.github/workflows/notify_test_workflow.yml

@@ -0,0 +1,171 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Intentionally has a general name.
+# because the test status check created in GitHub Actions
+# currently randomly picks any associated workflow.
+# So, the name was changed to make sense in that context too.
+# See also https://github.community/t/specify-check-suite-when-creating-a-checkrun/118380/10
+name: On pull request update
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+
+jobs:
+  notify:
+    name: Notify test workflow
+    runs-on: ubuntu-slim
+    permissions:
+      actions: read
+      checks: write
+    steps:
+      - name: "Notify test workflow"
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const endpoint = 'GET /repos/:owner/:repo/actions/workflows/:id/runs?&branch=:branch'
+            const check_run_endpoint = 'GET /repos/:owner/:repo/commits/:ref/check-runs?per_page=100'
+
+            // TODO: Should use pull_request.user and pull_request.user.repos_url?
+            // If a different person creates a commit to another forked repo,
+            // it wouldn't be able to detect.
+            const params = {
+              owner: context.payload.pull_request.head.repo.owner.login,
+              repo: context.payload.pull_request.head.repo.name,
+              id: 'build_main.yml',
+              branch: context.payload.pull_request.head.ref,
+            }
+            const check_run_params = {
+              owner: context.payload.pull_request.head.repo.owner.login,
+              repo: context.payload.pull_request.head.repo.name,
+              ref: context.payload.pull_request.head.ref,
+            }
+
+            console.log('Ref: ' + context.payload.pull_request.head.ref)
+            console.log('SHA: ' + context.payload.pull_request.head.sha)
+
+            // Wait 3 seconds to make sure the fork repository triggered a workflow.
+            await new Promise(r => setTimeout(r, 3000))
+
+            let runs
+            try {
+              runs = await github.request(endpoint, params)
+            } catch (error) {
+              console.error(error)
+              // Assume that runs were not found.
+            }
+
+            const name = 'Build'
+            const head_sha = context.payload.pull_request.head.sha
+            let status = 'queued'
+
+            if (!runs || runs.data.workflow_runs.length === 0) {
+              status = 'completed'
+              const conclusion = 'action_required'
+
+              github.rest.checks.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: name,
+                head_sha: head_sha,
+                status: status,
+                conclusion: conclusion,
+                output: {
+                  title: 'Workflow run detection failed',
+                  summary: `
+            Unable to detect the workflow run for testing the changes in your PR.
+
+            1. If you did not enable GitHub Actions in your forked repository, please enable it by clicking the button as shown in the image below. See also [Managing Github Actions Settings for a repository](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository) for more details.
+            2. It is possible your branch is based on the old \`main\` branch in Apache Datafusion Comet, please sync your branch to the latest main branch. For example as below:
+                \`\`\`bash
+                git fetch upstream
+                git rebase upstream/main
+                git push origin YOUR_BRANCH --force
+                \`\`\``,
+                  images: [
+                    {
+                      alt: 'enabling workflows button',
+                      image_url: 'https://raw.githubusercontent.com/apache/datafusion-comet/main/.github/workflows/images/workflow-enable-button.png'
+                    }
+                  ]
+                }
+              })
+            } else {
+              const run_id = runs.data.workflow_runs[0].id
+
+              if (runs.data.workflow_runs[0].head_sha != context.payload.pull_request.head.sha) {
+                throw new Error('There was a new unsynced commit pushed. Please retrigger the workflow.');
+              }
+
+              // Here we get check run ID to provide Check run view instead of Actions view, see also SPARK-37879.
+              let retryCount = 0;
+              let check_run_head;
+              while (retryCount < 3) {
+                const check_runs = await github.request(check_run_endpoint, check_run_params);
+                check_run_head = check_runs.data.check_runs.find(r => r.name === "Run / CI / Preflight");
+                if (check_run_head) {
+                  break;
+                }
+                retryCount++;
+                if (retryCount < 3) {
+                  await new Promise(resolve => setTimeout(resolve, 3000));
+                }
+              }
+              if (!check_run_head) {
+                throw new Error('Failed to retrieve check_run_head after 3 attempts');
+              }
+
+              if (check_run_head.head_sha != context.payload.pull_request.head.sha) {
+                throw new Error('There was a new unsynced commit pushed. Please retrigger the workflow.');
+              }
+
+              const check_run_url = 'https://github.com/'
+                + context.payload.pull_request.head.repo.full_name
+                + '/runs/'
+                + check_run_head.id
+              console.log('Check run URL: ' + check_run_url)
+
+              const actions_url = 'https://github.com/'
+                + context.payload.pull_request.head.repo.full_name
+                + '/actions/runs/'
+                + run_id
+              console.log('Actions URL: ' + actions_url)
+
+              github.rest.checks.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: name,
+                head_sha: head_sha,
+                status: status,
+                output: {
+                  title: 'Test results',
+                  summary: '[See test results](' + check_run_url + ')\n\n'
+                    + 'If the tests fail for reasons unrelated to this pull request, '
+                    + 'please rerun the workflow in your forked repository.\n'
+                    + 'If the failures are related to this pull request, '
+                    + 'please investigate them and push follow-up changes.',
+                  text: JSON.stringify({
+                    owner: context.payload.pull_request.head.repo.owner.login,
+                    repo: context.payload.pull_request.head.repo.name,
+                    run_id: run_id
+                  })
+                },
+                details_url: actions_url,
+              })
+            }

.github/workflows/pr_title_check.yml

@@ -21,9 +21,12 @@ concurrency:
   group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
   cancel-in-progress: true
 
+# CI DISABLED 2026-05-31 — auto-trigger commented out, only manual workflow_dispatch remains.
+# To rollback: remove `workflow_dispatch:` and restore the commented `pull_request` block below.
 on:
-  pull_request:
-    types: [opened, edited, reopened]
+  workflow_dispatch:
+  # pull_request:
+  #   types: [opened, edited, reopened]
 
 jobs:
   check-pr-title: