Only run install and dependency tests on merge (#505)

## Problem

Making changes in this repository sometimes feels slow because of the
amount of tests triggered on every push. Many tests, especially checking
the dependency matrix, are unlikely to fail unless dependencies have
changed so we can run them less often when certain specific conditions
are met.

## Solution

- Instead of testing install and the dependency matrix on every push on
a PR in progress, refactor github workflows to only run these
(`testing-install.yaml`, and `testing-dependency.yaml`) when pushing to
a branch where work is being integrated (e.g. `main` or
`release-candidate/*`).
- Add an additional PR workflow that only triggers when `pyproject.toml`
or `poetry.lock` are modified. When dependencies are changed, we do need
to run the entire dependency testing matrix.

## Type of Change

- [x] Infrastructure change (CI configs, etc)

Author: jhamon

.github/workflows/pr.yaml renamed to .github/workflows/on-merge.yaml

@@ -1,24 +1,10 @@
-name: Pull Request
+name: Testing (main)
 
 on:
-  pull_request:
-    paths-ignore:
-      - 'docs/**'
-      - '*.md'
-      - '*.rst'
-      - '*.txt'
-      - '*.html'
-      - '*.css'
-      - '*.js'
-      - '*.png'
-      - '*.jpg'
-      - '*.jpeg'
-      - '*.gif'
-      - '*.svg'
-      - '*.example'
   push:
     branches:
       - main
+      - release-candidate/*
     paths-ignore:
       - 'docs/**'
       - '*.md'
@@ -35,13 +21,15 @@ on:
       - '*.example'
   workflow_dispatch: {}
 
+permissions: {}
+
 concurrency:
   group: 'ci-${{ github.workflow }}-${{ github.ref }}'
   cancel-in-progress: true
 
 jobs:
   linting:
-    uses: './.github/workflows/lint.yaml'
+    uses: './.github/workflows/testing-lint.yaml'
 
   unit-tests:
     uses: './.github/workflows/testing-unit.yaml'
@@ -57,7 +45,7 @@ jobs:
     secrets: inherit
     needs: unit-tests
 
-  testing-install:
+  install-tests:
     uses: './.github/workflows/testing-install.yaml'
     secrets: inherit
 

.github/workflows/on-pr-dep-change.yaml

@@ -0,0 +1,19 @@
+name: Testing (PR - Dependency Change)
+
+on:
+  pull_request:
+    paths:
+      - 'pyproject.toml'
+      - 'poetry.lock'
+  workflow_dispatch: {}
+
+permissions: {}
+
+concurrency:
+  group: 'ci-${{ github.workflow }}-${{ github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  dependency-tests:
+    uses: './.github/workflows/testing-dependency.yaml'
+    secrets: inherit

.github/workflows/on-pr.yaml

@@ -0,0 +1,38 @@
+name: Testing (PR)
+
+on:
+  pull_request:
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+      - '*.rst'
+      - '*.txt'
+      - '*.html'
+      - '*.css'
+      - '*.js'
+      - '*.png'
+      - '*.jpg'
+      - '*.jpeg'
+      - '*.gif'
+      - '*.svg'
+      - '*.example'
+  workflow_dispatch: {}
+
+permissions: {}
+
+concurrency:
+  group: 'ci-${{ github.workflow }}-${{ github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  linting:
+    uses: './.github/workflows/testing-lint.yaml'
+
+  unit-tests:
+    uses: './.github/workflows/testing-unit.yaml'
+    secrets: inherit
+
+  integration-tests:
+      uses: './.github/workflows/testing-integration.yaml'
+      secrets: inherit
+      needs: unit-tests

.github/workflows/alpha-release.yaml renamed to .github/workflows/release-dev.yaml

@@ -23,23 +23,11 @@ on:
         type: string
         default: 'rc1'
 
+permissions:
+  contents: write
 jobs:
-  # unit-tests:
-  #   uses: './.github/workflows/testing-unit.yaml'
-  #   secrets: inherit
-  # integration-tests:
-  #     uses: './.github/workflows/testing-integration.yaml'
-  #     secrets: inherit
-  # dependency-tests:
-  #   uses: './.github/workflows/testing-dependency.yaml'
-  #   secrets: inherit
-
   pypi:
     uses: './.github/workflows/publish-to-pypi.yaml'
-    # needs:
-    #   - unit-tests
-    #   - integration-tests
-    #   - dependency-tests
     with:
       isPrerelease: true
       ref: ${{ inputs.ref }}

.github/workflows/release.yaml renamed to .github/workflows/release-prod.yaml

@@ -18,6 +18,9 @@ on:
           - 'minor' # new features, backwards compatible
           - 'major' # breaking changes
 
+permissions:
+  contents: write
+
 jobs:
   unit-tests:
     uses: './.github/workflows/testing-unit.yaml'
@@ -28,13 +31,18 @@ jobs:
   dependency-tests:
     uses: './.github/workflows/testing-dependency.yaml'
     secrets: inherit
+    needs: unit-tests
+  install-tests:
+    uses: './.github/workflows/testing-install.yaml'
+    secrets: inherit
 
   pypi:
     uses: './.github/workflows/publish-to-pypi.yaml'
-    needs: 
+    needs:
       - unit-tests
       - integration-tests
       - dependency-tests
+      - install-tests
     with:
       isPrerelease: false
       ref: ${{ inputs.ref }}
@@ -48,5 +56,5 @@ jobs:
   docs-publish:
     uses: './.github/workflows/build-and-publish-docs.yaml'
     secrets: inherit
-    needs: 
+    needs:
       - pypi

.github/workflows/lint.yaml renamed to .github/workflows/testing-lint.yaml

@@ -2,6 +2,8 @@ name: "Lint"
 on:
   workflow_call: {}
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest