[ci] dynamic ci (#4135)

This PR revamps how our GitHub workflows are invoked so that only the
necessary workflows are run and we avoid situations where a change to
the `README.md` gets blocked on an Apple runner failing to compile
Multipass due to a spurious seg fault.

This setup works by having a single orchestration workflow which filters
the changed files with
[dorny/paths-filter](https://github.com/dorny/paths-filter), defines
relevant outputs, and then spawns the relevant workflows. A "Finalize"
job in the orchestration workflow then checks the return statuses of the
spawned workflows and sets it own return status accordingly.

Regarding branch protection rules, the idea is that we would protect on
`Dynamic-CI \ Filter changed files` and `Dynamic-CI \ Finalize` to make
sure that the PR is properly analyzed and and errors from spawned
workflows are propagated up, effectively gating the PR from being
merged.

Below are some example draft PRs demonstrating various scenarios and how
the new CI setup reacts to them.

1. Documentation changes (#4136)
-
https://github.com/canonical/multipass/actions/runs/15478104252/job/43578947769?pr=4136
demonstrates a run that has been cancelled.
2. Documentation changes that fail to build (#4143)
3. Source code changes (#4137)
4. Changes that are neither documentation or source code (#4142)
5. Changing both documentation and code, but having one fail (#4144)

Merge queues aren't officially supported in the `dorny/paths-filter`
action, but there are several user submitted examples of people using
the action in this manner. Because of repository permissions this has
yet to have been tested.

Another GitHub action;
[tj-actions/changed-files](https://github.com/tj-actions/changed-files)
was considered for added functionality of being able to spawn workflows.
However, I chose not to go with it due to it's increased complexity and
granularity of control that isn't strictly needed in our setup.

One other thing, `docs/readthedocs.com:canonical-multipass` will
continue to be built for every PR regardless of changed files. The
trigger for this workflow is managed by
[ReadtheDocs](https://app.readthedocs.com/dashboard/canonical-multipass/pull-requests/)
which does not offer the granularity or control of being able to
selectively control when the workflow is run.

One slight improvement that can be made to further optimize CI would be
to bisect `windows-macos.yml` and further filter on files that only
affect Windows or macOS builds. However, care would need to be taken in
order to ensure that there is no unnoticed cross-platform dependencies
in these filtered files.

Closes #4136
Closes #4143
Closes #4137
Closes #4142
Closes #4144

---

MULTI-1932

---

Author: sharder996

.github/actions/check-lint/action.yml

@@ -20,7 +20,7 @@ runs:
       id: wait-lint
       with:
         token: ${{ github.token }}
-        checkName: Lint
+        checkName: Lint / Lint
         ref: ${{ inputs.sha }}
         timeoutSeconds: 120
         intervalSeconds: 5

.github/workflows/automatic-doc-checks.yml

@@ -2,17 +2,7 @@
 name: Automatic doc checks
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    paths:
-      - "docs/**"
-      - ".github/workflows/automatic-doc-checks.yml"
-  merge_group:
-    types: [checks_requested]
-    paths:
-      - "docs/**"
-      - ".github/workflows/automatic-doc-checks.yml"
+  workflow_call:
   workflow_dispatch:
     # Manual trigger
 

.github/workflows/dynamic-ci.yml

@@ -25,7 +25,6 @@ jobs:
     outputs:
       docs: ${{ steps.filter.outputs.docs }}
       code: ${{ steps.filter.outputs.code }}
-      hooks: ${{ steps.filter.outputs.hooks }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -57,12 +56,11 @@ jobs:
               - "snap-wrappers/**"
               - "src/**"
               - "tests/**"
+              - "tools/**"
               - ".gitmodules"
               - "CMakeLists.txt"
               - "vcpkg-configuration.json"
               - "vcpkg.json"
-            hooks:
-              - "git-hooks/**"
 
 
   docs:
@@ -90,17 +88,11 @@ jobs:
     uses: "./.github/workflows/windows-macos.yml"
     secrets: inherit
 
-  hooks:
-    name: Hooks
-    needs: filter
-    if: needs.filter.outputs.hooks == 'true'
-    uses: "./.github/workflows/test-hooks.yml"
-
   finalize:
     name: Finalize
     runs-on: ubuntu-latest
     if: ${{ always() }}
-    needs: [docs, lint, linux, windows-macos, hooks]
+    needs: [docs, lint, linux, windows-macos]
     steps:
       - name: Docs failure check
         if: ${{
@@ -115,7 +107,3 @@ jobs:
           needs.windows-macos.result == 'failure' || needs.windows-macos.result == 'cancelled'
           }}
         run: exit 1
-
-      - name: Hooks failure check
-        if: ${{ needs.hooks.result == 'failure' || needs.hooks.result == 'cancelled' }}
-        run: exit 1

.github/workflows/lint.yml

@@ -1,16 +1,7 @@
 name: Lint
 
 on:
-  push:
-    branches:
-      - main
-      - release/[0-9]+.[0-9]+
-    tags:
-      - v[0-9]+.[0-9]+.[0-9]+
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-  merge_group:
-    types: [checks_requested]
+  workflow_call:
 
 jobs:
   Lint:

.github/workflows/linux.yml

@@ -1,16 +1,7 @@
 name: Linux
 
 on:
-  push:
-    branches:
-      - main
-      - release/[0-9]+.[0-9]+
-    tags:
-      - v[0-9]+.[0-9]+.[0-9]+
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-  merge_group:
-    types: [checks_requested]
+  workflow_call:
 
 concurrency:
   group: linux-${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/windows-macos.yml

@@ -1,16 +1,7 @@
 name: WindowsMacOS
 
 on:
-  push:
-    branches:
-      - main
-      - release/[0-9]+.[0-9]+
-    tags:
-      - v[0-9]+.[0-9]+.[0-9]+
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-  merge_group:
-    types: [checks_requested]
+  workflow_call:
 
 concurrency:
   group: windows-macos-${{ github.workflow }}-${{ github.event.number && format('pr{0}', github.event.number) || github.run_id }}