ci: split ci into privileged and unprivileged workflows

Split the workflows to prevent unexpected overlap between environments.

Author: josephperrott

.github/workflows/ci.yml

@@ -5,8 +5,6 @@ on:
     branches:
       - main
       - '[0-9]+.[0-9]+.x'
-  pull_request:
-    types: [opened, synchronize, reopened]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -46,18 +44,8 @@ jobs:
         run: yarn tslint
       - name: Check for circular dependencies
         run: yarn -s ts-circular-deps:check
-      - name: Check commit message
-        # Commit message validation is only done on pull requests as its too late to validate once
-        # it has been merged.
-        if: github.event_name == 'pull_request'
-        run: yarn ng-dev commit-message validate-range ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }}
-      - name: Check code format
-        # Code formatting checks are only done on pull requests as its too late to validate once
-        # it has been merged.
-        if: github.event_name == 'pull_request'
-        run: yarn ng-dev format changed --check ${{ github.event.pull_request.base.sha }}
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'Lint check'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
@@ -78,7 +66,7 @@ jobs:
       - name: Check API Goldens
         run: yarn bazel test tools/public_api_guard/...
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'API Golden Checks'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
@@ -99,7 +87,7 @@ jobs:
       - name: Run e2e tests
         run: yarn e2e --flaky_test_attempts=2
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'E2E test'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
@@ -123,7 +111,7 @@ jobs:
         run: yarn integration-tests:size-test
         continue-on-error: true
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'Integration test'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
@@ -144,7 +132,7 @@ jobs:
       - name: Run linker AOT tests
         run: yarn test-linker-aot
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'Link AOT test'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
@@ -165,7 +153,7 @@ jobs:
       - name: Run linker JIT tests
         run: yarn test-linker-jit
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'Link JIT test'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
@@ -186,7 +174,7 @@ jobs:
       - name: Run tests
         run: bazel test --build_tag_filters=-e2e --test_tag_filters=-e2e --build_tests_only -- src/...
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'Test'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
@@ -207,13 +195,12 @@ jobs:
       - name: Run tests
         run: bazel build --build_tag_filters=-docs-package,-release-package -- src/...
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'Build'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
 
   publish_snapshots:
-    if: ${{ github.event_name == 'push'}}
     runs-on: ubuntu-latest-4core
     steps:
       - name: Initialize environment
@@ -239,39 +226,12 @@ jobs:
         env:
           SNAPSHOT_BUILDS_GITHUB_TOKEN: ${{ secrets.SNAPSHOT_BUILDS_GITHUB_TOKEN }}
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'Snapshot publishing'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
 
-  upload_package_artifacts:
-    if: ${{ github.event_name != 'push'}}
-    runs-on: ubuntu-latest-4core
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@804107deac3621184db54fab3e7cfe7f735a0d74
-        with:
-          cache-node-modules: true
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@804107deac3621184db54fab3e7cfe7f735a0d74
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@804107deac3621184db54fab3e7cfe7f735a0d74
-      - name: Install node modules
-        run: yarn install --frozen-lockfile
-      - name: Build and Verify Release Output
-        run: yarn build-and-check-release-output
-      - name: Verify tooling setup
-        run: yarn check-tooling-setup
-      - name: Build and create package artifacts
-        run: ./scripts/create-package-archives.js --suffix "pr${{github.event.number}}-$(git rev-parse --short HEAD)"
-      - name: Upload artifacts
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # tag=v4.3.1
-        with:
-          name: Package Artifacts
-          path: dist/release-archives
-
   deploy_doc_site:
-    if: ${{ github.event_name == 'push'}}
     runs-on: ubuntu-latest-4core
     steps:
       - name: Initialize environment
@@ -296,7 +256,7 @@ jobs:
           DOCS_SITE_GCP_SERVICE_KEY: ${{ secrets.DOCS_SITE_GCP_SERVICE_KEY }}
           DOCS_DEPLOY_GITHUB_TOKEN: ${{ secrets.DOCS_DEPLOY_GITHUB_TOKEN }}
       - uses: ./.github/actions/slack
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: failure()
         with:
           JOB_NAME: 'Docs site deployment'
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
@@ -313,8 +273,6 @@ jobs:
         uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@804107deac3621184db54fab3e7cfe7f735a0d74
         with:
           cache-node-modules: true
-          # Checking out the pull request commit is intended here as we need to run the changed code tests.
-          ref: ${{ github.event.pull_request.head.sha }}
       - name: Install node modules
         run: yarn install --frozen-lockfile
       - name: Setup Bazel
@@ -335,8 +293,6 @@ jobs:
         uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@804107deac3621184db54fab3e7cfe7f735a0d74
         with:
           cache-node-modules: true
-          # Checking out the pull request commit is intended here as we need to run the changed code tests.
-          ref: ${{ github.event.pull_request.head.sha }}
       - name: Install node modules
         run: yarn install --frozen-lockfile
       - name: Setup Bazel