ci: Gate manual release workflows on wait-for-checks

.github/workflows/_checks.yaml

@@ -0,0 +1,182 @@
+name: Checks
+
+on:
+  # Runs when manually triggered from the GitHub UI.
+  workflow_dispatch:
+    inputs:
+      run_tests:
+        description: Whether to run the test suites (unit, integration).
+        required: false
+        type: boolean
+        default: true
+
+  # Runs when invoked by another workflow.
+  workflow_call:
+    inputs:
+      run_tests:
+        description: Whether to run the test suites (unit, integration).
+        required: false
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+env:
+  PYTHON_VERSION: 3.14
+
+jobs:
+  actions_lint_check:
+    name: Actions lint check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Run actionlint
+        uses: rhysd/actionlint@v1.7.11
+
+  spell_check:
+    name: Spell check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Check spelling with typos
+        uses: crate-ci/typos@v1
+
+  lint_check:
+    name: Lint check
+    uses: apify/workflows/.github/workflows/python_lint_check.yaml@main
+    with:
+      python_versions: '["3.11", "3.12", "3.13", "3.14"]'
+
+  type_check:
+    name: Type check
+    uses: apify/workflows/.github/workflows/python_type_check.yaml@main
+    with:
+      python_versions: '["3.11", "3.12", "3.13", "3.14"]'
+
+  docstrings_check:
+    name: Docstrings check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Set up uv package manager
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install dependencies
+        run: uv run poe install-dev
+
+      - name: Async docstrings check
+        run: uv run poe check-docstrings
+
+  unit_tests:
+    name: Unit tests
+    if: inputs.run_tests
+    uses: apify/workflows/.github/workflows/python_unit_tests.yaml@main
+    secrets: inherit
+    with:
+      python_versions: '["3.11", "3.12", "3.13", "3.14"]'
+      operating_systems: '["ubuntu-latest", "windows-latest"]'
+      python_version_for_codecov: "3.14"
+      operating_system_for_codecov: ubuntu-latest
+      tests_concurrency: "16"
+
+  # Integration tests are inlined (not calling the reusable workflow) to avoid GitHub's compile-time secret
+  # validation for nested reusable workflows, which fails on fork PRs where repo secrets are not available.
+  integration_tests:
+    name: Integration tests (${{ matrix.python-version }}, ${{ matrix.os }})
+    if: >-
+      ${{
+        inputs.run_tests && (
+          (github.event_name == 'pull_request' && github.event.pull_request.head.repo.owner.login == 'apify') ||
+          (github.event_name == 'push' && github.ref == 'refs/heads/master') ||
+          github.event_name == 'workflow_dispatch'
+        )
+      }}
+
+    strategy:
+      matrix:
+        os: ["ubuntu-latest"]
+        python-version: ["3.11", "3.14"]
+
+    runs-on: ${{ matrix.os }}
+
+    env:
+      TESTS_CONCURRENCY: "16"
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Set up uv package manager
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Python dependencies
+        run: uv run poe install-dev
+
+      - name: Run integration tests
+        run: uv run poe integration-tests-cov
+        env:
+          APIFY_TEST_USER_API_TOKEN: ${{ secrets.APIFY_TEST_USER_PYTHON_SDK_API_TOKEN }}
+          APIFY_TEST_USER_2_API_TOKEN: ${{ secrets.APIFY_TEST_USER_2_API_TOKEN }}
+
+      - name: Upload integration test coverage
+        if: >-
+          ${{
+            matrix.os == 'ubuntu-latest' &&
+            matrix.python-version == '3.14' &&
+            env.CODECOV_TOKEN != ''
+          }}
+        uses: codecov/codecov-action@v6
+        with:
+          token: ${{ env.CODECOV_TOKEN }}
+          files: coverage-integration.xml
+          flags: integration
+
+  package_check:
+    name: Package check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up uv package manager
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          python-version: "3.14"
+
+      - name: Build sdist and wheel
+        run: uv run poe build
+
+      - name: Verify built package
+        uses: apify/actions/python-package-check@v1.1.0
+        with:
+          package_name: apify_client
+          dist_dir: dist
+          python_version: "3.14"
+          smoke_code: |
+            from apify_client import ApifyClient, ApifyClientAsync
+            ApifyClient(token='x')
+            ApifyClientAsync(token='x')
+
+  doc_check:
+    name: Doc check
+    uses: apify/workflows/.github/workflows/python_docs_check.yaml@main