ci: post Python Integration Tests check as the driver-test app (fix app-pinned gate)

The required 'Python Integration Tests' check is pinned in the main ruleset to
the driver-test app (driver-integration-test, integration_id 2731531). But the
PR-side placeholder was posted via github.token, so it landed as github-actions
— a DIFFERENT check context that does NOT satisfy the app-pinned gate. Result:
the required check sat unfulfilled and PRs stayed BLOCKED even though a green
'Python Integration Tests' appeared in the list (e.g. #882).

Mirror databricks-sql-go #426 / databricks-sql-nodejs #459:

- Add skip-checks-reporter.yml, triggered by workflow_run on 'Trigger
  Integration Tests'. It runs in the base-repo context with secret access even
  for fork-triggered runs, mints the INTEGRATION_TEST_APP token, and posts
  'Python Integration Tests'=success on every PR head — forks included — as the
  driver-test app, so the app-pinned gate is satisfied and every PR auto-enqueues.
- Remove the inline skip-integration-tests-pr github.token stub (superseded;
  it posted under the wrong app and 403'd on forks entirely).
- In merge-queue-python, mint the app token unconditionally and post the
  auto-pass (no-driver-change) and dispatch-failure checks with IT — the
  merge_group path isn't covered by the reporter, and a github.token check there
  likewise can't satisfy the pinned gate (queue would hang). The real result was
  already posted back by driver-test as the app; this aligns the no-op paths.

The labeled-PR preview's inline checks stay on github.token (cosmetic; the
reporter owns the pinned gate on pull_request events), matching go/nodejs.

Co-authored-by: Isaac
Signed-off-by: eric-wang-1990 <e.wang@databricks.com>

Author: eric-wang-1990

.github/workflows/skip-checks-reporter.yml

@@ -0,0 +1,74 @@
+name: Report Integration Test Skip
+
+# Posts the PR-open "skipped" placeholder for the required
+# `Python Integration Tests` check, as the driver-test GitHub App.
+#
+# Why a separate workflow (and not an inline job in trigger-integration-tests.yml):
+#   - The branch ruleset pins the required `Python Integration Tests` check to the
+#     driver-test app's integration id (driver-integration-test). Only a check
+#     posted BY that app satisfies the gate — a `github.token` (github-actions)
+#     check of the same name does NOT (it is a different check context).
+#   - A PR from a fork runs its `pull_request` workflows with a READ-ONLY GITHUB_TOKEN
+#     and no access to secrets, so it cannot mint the app token and cannot post any
+#     check on its own head. That would leave fork PRs unable to enter the merge queue
+#     without a maintainer label.
+#   - `workflow_run` workflows always execute in THIS (base) repo's context using the
+#     workflow definition from the default branch, with full secret access — even when
+#     the run that triggered them came from a fork. That lets us post the app-attributed
+#     placeholder on any PR head, fork or not, so every PR can auto-enqueue.
+#
+# SECURITY: this workflow runs with secrets in a privileged context. It MUST NOT check
+# out or execute any PR/fork-controlled content. It only calls checks.create with a
+# static body; the sole fork-controlled input is `workflow_run.head_sha`, an opaque
+# commit SHA passed to the API. Do not add `actions/checkout` or a `run:` step that
+# executes repo content here.
+#
+# The real integration suite is unaffected: it runs as the required gate on the
+# `merge_group` commit (and as a label preview on internal PRs), dispatched by
+# trigger-integration-tests.yml. This workflow only posts the pre-merge placeholder.
+# Mirrors databricks-sql-go / databricks-sql-nodejs.
+
+on:
+  workflow_run:
+    workflows: ["Trigger Integration Tests"]
+    types: [requested]
+
+jobs:
+  report-skip:
+    # Only for PR-triggered runs; the merge_group run posts the real required check.
+    if: github.event.workflow_run.event == 'pull_request'
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+    permissions:
+      checks: write
+    steps:
+      - name: Generate GitHub App token (this repo)
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        with:
+          app-id: ${{ secrets.INTEGRATION_TEST_APP_ID }}
+          private-key: ${{ secrets.INTEGRATION_TEST_PRIVATE_KEY }}
+          owner: databricks
+          repositories: databricks-sql-python
+
+      - name: Post skipped Python Integration Tests check
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        env:
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            await github.rest.checks.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: 'Python Integration Tests',
+              head_sha: process.env.HEAD_SHA,
+              status: 'completed',
+              conclusion: 'success',
+              completed_at: new Date().toISOString(),
+              output: {
+                title: 'Skipped on PR — runs in merge queue',
+                summary: 'Python Integration Tests are skipped on ordinary PR events and run as the required gate in the merge queue (dispatched to databricks-driver-test). Add the `integration-test` label to preview them on this PR. (Label previews cannot run on fork PRs, which lack secret access; fork PRs are exercised by the required merge-queue run.)',
+              },
+            });

.github/workflows/trigger-integration-tests.yml

@@ -116,55 +116,16 @@ jobs:
               body: body
             });
 
-  # =============================================================================
-  # For PRs: Always pass the Python Integration Tests check on
-  # non-label events. The real run happens in the merge queue (or via
-  # explicit label preview). Without this, the required
-  # `Python Integration Tests` check would block every PR that doesn't
-  # bother labelling.
-  # =============================================================================
-  skip-integration-tests-pr:
-    if: github.event_name == 'pull_request' && github.event.action != 'labeled' && github.event.action != 'closed'
-    runs-on:
-      group: databricks-protected-runner-group
-      labels: linux-ubuntu-latest
-    permissions:
-      checks: write
-    steps:
-      - name: Skip Python Integration Tests
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
-        with:
-          github-token: ${{ github.token }}
-          script: |
-            // On FORK PRs GitHub forces GITHUB_TOKEN to read-only regardless of
-            // the declared `checks: write`, so checks.create 403s ("Resource
-            // not accessible by integration"). Expected — a fork can't post
-            // check-runs on the base repo. Swallow the 403 for forks so this
-            // poster doesn't show a spurious failure; the real Python
-            // Integration Tests required check is posted by the merge_group run
-            // (full perms) when a maintainer queues the PR. Other errors fail loudly.
-            const isFork = context.payload.pull_request.head.repo.fork;
-            try {
-              await github.rest.checks.create({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                name: 'Python Integration Tests',
-                head_sha: context.payload.pull_request.head.sha,
-                status: 'completed',
-                conclusion: 'success',
-                completed_at: new Date().toISOString(),
-                output: {
-                  title: 'Skipped on PR — runs in merge queue',
-                  summary: 'Python Integration Tests are skipped on PRs and run as a required gate in the merge queue. Add the `integration-test` label to preview them on this PR.'
-                }
-              });
-            } catch (e) {
-              if (isFork && e.status === 403) {
-                core.notice('Fork PR: cannot post the Python Integration Tests check-run (read-only token). It will be posted by the merge queue at merge time.');
-              } else {
-                throw e;
-              }
-            }
+  # NOTE: the PR-open "skipped" placeholder for the required
+  # `Python Integration Tests` check is NOT posted here. It is posted by the
+  # companion workflow `skip-checks-reporter.yml`, which runs on `workflow_run`
+  # in the base-repo context so it can post the check as the driver-test app —
+  # the app the branch ruleset PINS the required check to — on EVERY PR head,
+  # including fork PRs (whose own `pull_request` run gets a read-only token and
+  # cannot post checks at all). A `pull_request`-triggered `github.token` stub
+  # here posted the check as `github-actions`, which is a DIFFERENT check
+  # context and did NOT satisfy the app-pinned gate — so the required check sat
+  # unfulfilled and PRs stayed blocked. See skip-checks-reporter.yml.
 
   # =============================================================================
   # For PRs: Dispatch real tests when integration-test label is added.
@@ -333,6 +294,23 @@ jobs:
         with:
           fetch-depth: 0
 
+      # Mint the driver-test App token UNCONDITIONALLY. The required
+      # `Python Integration Tests` check is pinned in the ruleset to this app's
+      # integration id, so EVERY check this job posts — the real result (posted
+      # back by driver-test on dispatch), the no-op auto-pass, and the
+      # dispatch-failure — must be attributed to the same app, or it lands on a
+      # different check context and never satisfies the pinned gate (leaving the
+      # merge queue stuck). merge_group runs on the base repo with full secret
+      # access, so the mint always succeeds here.
+      - name: Generate GitHub App Token (internal repo)
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        with:
+          app-id: ${{ secrets.INTEGRATION_TEST_APP_ID }}
+          private-key: ${{ secrets.INTEGRATION_TEST_PRIVATE_KEY }}
+          owner: databricks
+          repositories: databricks-driver-test
+
       - name: Check if driver files changed
         id: changed
         env:
@@ -352,9 +330,9 @@ jobs:
         if: steps.changed.outputs.changed != 'true'
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
-          # Default workflow token — see the trigger-tests-pr job's
-          # equivalent step above for the rationale.
-          github-token: ${{ github.token }}
+          # App token, not github.token — the pinned required check is only
+          # satisfied by a check posted BY the driver-test app.
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             await github.rest.checks.create({
               owner: context.repo.owner,
@@ -386,16 +364,6 @@ jobs:
             exit 1
           fi
 
-      - name: Generate GitHub App Token (internal repo)
-        if: steps.changed.outputs.changed == 'true'
-        id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
-        with:
-          app-id: ${{ secrets.INTEGRATION_TEST_APP_ID }}
-          private-key: ${{ secrets.INTEGRATION_TEST_PRIVATE_KEY }}
-          owner: databricks
-          repositories: databricks-driver-test
-
       - name: Dispatch Python tests
         if: steps.changed.outputs.changed == 'true'
         uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
@@ -418,9 +386,10 @@ jobs:
         if: failure() && steps.changed.outputs.changed == 'true'
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
-          # Use the default workflow token, not the App token — see
-          # the rationale in the trigger-tests-pr job above.
-          github-token: ${{ github.token }}
+          # App token, not github.token — a github-actions failure check lands on
+          # a different context than the pinned gate, leaving the required check
+          # pending until the queue times out instead of failing fast.
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             await github.rest.checks.create({
               owner: context.repo.owner,