From 1700fc025edd66637a247d8417cfedd4197ec1f0 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 11:37:38 +1000
Subject: [PATCH 01/16] Skip external branches in ci-unit-tests-docker.yml

---
 .github/workflows/ci-unit-tests-docker.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/ci-unit-tests-docker.yml b/.github/workflows/ci-unit-tests-docker.yml
index 73834aa649f..96448d817d7 100644
--- a/.github/workflows/ci-unit-tests-docker.yml
+++ b/.github/workflows/ci-unit-tests-docker.yml
@@ -21,6 +21,15 @@ on:
         default: false
 
   pull_request:
+    # Skip branches from external repositories, let them pass, and then Mergify will check them
+    branches:
+      # Include all branches
+      - '**'
+      # Exclude external repositories
+      - '!**/**'
+      # But include mergify and dependabot
+      - 'mergify/**'
+      - 'dependabot/**'
     paths:
       # code and tests
       - '**/*.rs'

From e2534fef13a0925c8ecbda36ee7b0ea98a069871 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 11:41:27 +1000
Subject: [PATCH 02/16] Patch external repositories in
 ci-unit-tests-docker.patch.yml

---
 .github/workflows/ci-unit-tests-docker.patch.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/ci-unit-tests-docker.patch.yml b/.github/workflows/ci-unit-tests-docker.patch.yml
index c9c69768f54..0bcb271ae5b 100644
--- a/.github/workflows/ci-unit-tests-docker.patch.yml
+++ b/.github/workflows/ci-unit-tests-docker.patch.yml
@@ -4,6 +4,15 @@ name: Docker Unit Tests
 # so they can be skipped when the modified files make the actual workflow run.
 on:
   pull_request:
+    # Only run on branches from external repositories, let them pass, and then Mergify will check them
+    #
+    # IMPORTANT: these patterns are the reverse of the ones in the non-patch file.
+    branches:
+      # Patch only external repositories
+      - '**/**'
+      # But don't patch mergify and dependabot
+      - '!mergify/**'
+      - '!dependabot/**'
     paths-ignore:
       # code and tests
       - '**/*.rs'

From ccdbefad3c06478435e057314a73403a270d1103 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 11:57:25 +1000
Subject: [PATCH 03/16] Revert ci-unit-tests-docker.patch.yml

---
 .github/workflows/ci-unit-tests-docker.patch.yml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/.github/workflows/ci-unit-tests-docker.patch.yml b/.github/workflows/ci-unit-tests-docker.patch.yml
index 0bcb271ae5b..c9c69768f54 100644
--- a/.github/workflows/ci-unit-tests-docker.patch.yml
+++ b/.github/workflows/ci-unit-tests-docker.patch.yml
@@ -4,15 +4,6 @@ name: Docker Unit Tests
 # so they can be skipped when the modified files make the actual workflow run.
 on:
   pull_request:
-    # Only run on branches from external repositories, let them pass, and then Mergify will check them
-    #
-    # IMPORTANT: these patterns are the reverse of the ones in the non-patch file.
-    branches:
-      # Patch only external repositories
-      - '**/**'
-      # But don't patch mergify and dependabot
-      - '!mergify/**'
-      - '!dependabot/**'
     paths-ignore:
       # code and tests
       - '**/*.rs'

From 4dd623e65a57ef33b06424c4c5e82a4ac6a46663 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 12:08:28 +1000
Subject: [PATCH 04/16] Add a separate external PR patch in
 ci-unit-tests-docker.patch-external.yml

---
 .../ci-unit-tests-docker.patch-external.yml   | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 .github/workflows/ci-unit-tests-docker.patch-external.yml

diff --git a/.github/workflows/ci-unit-tests-docker.patch-external.yml b/.github/workflows/ci-unit-tests-docker.patch-external.yml
new file mode 100644
index 00000000000..01aec524f84
--- /dev/null
+++ b/.github/workflows/ci-unit-tests-docker.patch-external.yml
@@ -0,0 +1,61 @@
+# Workflow patches for skipping Google Cloud CI on PRs from external repositories.
+name: Docker Unit Tests
+
+# Run on PRs from external repositories, let them pass, and then Mergify will check them.
+on:
+  pull_request:
+    # IMPORTANT
+    #
+    # These patterns are the inverse of the ones in the non-patch file.
+    branches:
+      # Patch only external repositories
+      - '**/**'
+      # But don't patch mergify and dependabot
+      - '!mergify/**'
+      - '!dependabot/**'
+
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch.yml` and `.yml` files.
+jobs:
+  build:
+    name: Build CI Docker / Build images
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-all:
+    name: Test all
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-fake-activation-heights:
+    name: Test with fake activation heights
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-empty-sync:
+    name: Test checkpoint sync from empty state
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-lightwalletd-integration:
+    name: Test integration with lightwalletd
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-configuration-file:
+    name: Test CI default Docker config file / Test default-conf in Docker
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-zebra-conf-path:
+    name: Test CI custom Docker config file / Test custom-conf in Docker
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'

From 249978b981a4a6961fe611c40a6a4c11cdede2c5 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 12:08:37 +1000
Subject: [PATCH 05/16] Document ci-unit-tests-docker.patch.yml

---
 .github/workflows/ci-unit-tests-docker.patch.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-unit-tests-docker.patch.yml b/.github/workflows/ci-unit-tests-docker.patch.yml
index c9c69768f54..633752485cd 100644
--- a/.github/workflows/ci-unit-tests-docker.patch.yml
+++ b/.github/workflows/ci-unit-tests-docker.patch.yml
@@ -1,7 +1,7 @@
+# Workflow patches for skipping CI when Rust code and dependencies aren't modified in a PR.
 name: Docker Unit Tests
 
-# These jobs *don't* depend on cached Google Cloud state disks,
-# so they can be skipped when the modified files make the actual workflow run.
+# Run on PRs with unmodified code and dependency files.
 on:
   pull_request:
     paths-ignore:
@@ -25,6 +25,9 @@ on:
       - '.github/workflows/sub-find-cached-disks.yml'
       - '.github/workflows/sub-build-docker-image.yml'
 
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch-external.yml` and `.yml` files.
 jobs:
   build:
     name: Build CI Docker / Build images

From 73034d3d5c36b95e3f472bd9ac1c5c1e78f8ca3a Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 12:08:45 +1000
Subject: [PATCH 06/16] Document ci-unit-tests-docker.yml

---
 .github/workflows/ci-unit-tests-docker.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-unit-tests-docker.yml b/.github/workflows/ci-unit-tests-docker.yml
index 96448d817d7..a13598d6994 100644
--- a/.github/workflows/ci-unit-tests-docker.yml
+++ b/.github/workflows/ci-unit-tests-docker.yml
@@ -1,3 +1,4 @@
+# Google Cloud CI that runs when Rust code and dependencies are modified in a PR from the ZcashFoundation/zebra repository.
 name: Docker Unit Tests
 
 # Ensures that only one workflow task will run at a time. Previous builds, if
@@ -21,7 +22,7 @@ on:
         default: false
 
   pull_request:
-    # Skip branches from external repositories, let them pass, and then Mergify will check them
+    # Skip PRs from external repositories, let them pass, and then Mergify will check them
     branches:
       # Include all branches
       - '**'
@@ -30,6 +31,7 @@ on:
       # But include mergify and dependabot
       - 'mergify/**'
       - 'dependabot/**'
+    # Skip PRs where Rust code and dependencies aren't modified.
     paths:
       # code and tests
       - '**/*.rs'
@@ -53,6 +55,7 @@ on:
   push:
     branches:
       - main
+    # Skip main branch merges where Rust code and dependencies aren't modified.
     paths:
       # code and tests
       - '**/*.rs'
@@ -84,6 +87,9 @@ env:
   COLORBT_SHOW_HIDDEN: ${{ vars.COLORBT_SHOW_HIDDEN }}
   CARGO_INCREMENTAL: ${{ vars.CARGO_INCREMENTAL }}
 
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch.yml` and `.patch-external.yml` files.
 jobs:
   # Build the docker image used by the tests.
   #

From de5f69c603e2fb8ca8fa3443da271943b8174ce2 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 12:27:41 +1000
Subject: [PATCH 07/16] Skip dependabot config validation for external PRs

---
 .github/workflows/ci-lint.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml
index 12add6d2951..19eac034727 100644
--- a/.github/workflows/ci-lint.yml
+++ b/.github/workflows/ci-lint.yml
@@ -148,7 +148,11 @@ jobs:
         with:
           level: warning
           fail_on_error: false
+      # This gives an error when run on PRs from external repositories, so we skip it.
       - name: validate-dependabot
+        # If this is a PR, check that the PR source is from a local branch.
+        # (github.ref is always a local branch, so this check always passes for non-PRs.)
+        if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
         uses: marocchino/validate-dependabot@v2.1.0
 
   codespell:

From 3e6bd34a446ca21d94197c7211e887dad6c68567 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 12:33:22 +1000
Subject: [PATCH 08/16] Trivial Rust code modification to make Rust workflows
 run

---
 zebrad/src/application.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zebrad/src/application.rs b/zebrad/src/application.rs
index d8df9d3f009..f0ce1a204d8 100644
--- a/zebrad/src/application.rs
+++ b/zebrad/src/application.rs
@@ -1,4 +1,7 @@
 //! Zebrad Abscissa Application
+//!
+//! This is the code that starts `zebrad`, and launches its tasks and services.
+//! See [the crate docs](crate) and [the start docs](crate::commands::start) for more details.
 
 use std::{env, fmt::Write as _, io::Write as _, process, sync::Arc};
 

From e9d196c86b37c294d1172318f101c16a77efdc99 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 12:49:17 +1000
Subject: [PATCH 09/16] Use correct method for checking source branch refs

---
 .../ci-unit-tests-docker.patch-external.yml   | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci-unit-tests-docker.patch-external.yml b/.github/workflows/ci-unit-tests-docker.patch-external.yml
index 01aec524f84..2dc381122ea 100644
--- a/.github/workflows/ci-unit-tests-docker.patch-external.yml
+++ b/.github/workflows/ci-unit-tests-docker.patch-external.yml
@@ -2,17 +2,9 @@
 name: Docker Unit Tests
 
 # Run on PRs from external repositories, let them pass, and then Mergify will check them.
+# GitHub doesn't support filtering workflows by source branch names, so we have to do it for each job.
 on:
   pull_request:
-    # IMPORTANT
-    #
-    # These patterns are the inverse of the ones in the non-patch file.
-    branches:
-      # Patch only external repositories
-      - '**/**'
-      # But don't patch mergify and dependabot
-      - '!mergify/**'
-      - '!dependabot/**'
 
 # IMPORTANT
 #
@@ -20,42 +12,51 @@ on:
 jobs:
   build:
     name: Build CI Docker / Build images
+    # If this is a PR, check that the PR source is from a local branch.
+    # (github.ref is always a local branch, so this check always passes for non-PRs.)
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-all:
     name: Test all
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-fake-activation-heights:
     name: Test with fake activation heights
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-empty-sync:
     name: Test checkpoint sync from empty state
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-lightwalletd-integration:
     name: Test integration with lightwalletd
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-configuration-file:
     name: Test CI default Docker config file / Test default-conf in Docker
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-zebra-conf-path:
     name: Test CI custom Docker config file / Test custom-conf in Docker
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'

From ff2f496e9d74ae7f96d90f1d0441e7246360feec Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Fri, 17 Nov 2023 12:50:56 +1000
Subject: [PATCH 10/16] Fix the check condition

---
 .../ci-unit-tests-docker.patch-external.yml    | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci-unit-tests-docker.patch-external.yml b/.github/workflows/ci-unit-tests-docker.patch-external.yml
index 2dc381122ea..326209144fb 100644
--- a/.github/workflows/ci-unit-tests-docker.patch-external.yml
+++ b/.github/workflows/ci-unit-tests-docker.patch-external.yml
@@ -12,51 +12,51 @@ on:
 jobs:
   build:
     name: Build CI Docker / Build images
-    # If this is a PR, check that the PR source is from a local branch.
-    # (github.ref is always a local branch, so this check always passes for non-PRs.)
-    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
+    # Only run on PRs from external repositories. 
+    # (github.ref is always a local branch, so this check will skip non-PRs as well.)
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-all:
     name: Test all
-    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-fake-activation-heights:
     name: Test with fake activation heights
-    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-empty-sync:
     name: Test checkpoint sync from empty state
-    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-lightwalletd-integration:
     name: Test integration with lightwalletd
-    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-configuration-file:
     name: Test CI default Docker config file / Test default-conf in Docker
-    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-zebra-conf-path:
     name: Test CI custom Docker config file / Test custom-conf in Docker
-    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'

From e08710276439a5274bccc9d8e3966b29672d0679 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Tue, 21 Nov 2023 06:11:42 +1000
Subject: [PATCH 11/16] Simplify job structure

---
 .../ci-unit-tests-docker.patch-external.yml         | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci-unit-tests-docker.patch-external.yml b/.github/workflows/ci-unit-tests-docker.patch-external.yml
index 326209144fb..f314a92306c 100644
--- a/.github/workflows/ci-unit-tests-docker.patch-external.yml
+++ b/.github/workflows/ci-unit-tests-docker.patch-external.yml
@@ -21,42 +21,43 @@ jobs:
 
   test-all:
     name: Test all
-    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
+    # This dependency allows all these jobs to depend on a single condition, making it easier to change.
+    needs: build
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-fake-activation-heights:
     name: Test with fake activation heights
-    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
+    needs: build
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-empty-sync:
     name: Test checkpoint sync from empty state
-    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
+    needs: build
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-lightwalletd-integration:
     name: Test integration with lightwalletd
-    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
+    needs: build
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-configuration-file:
     name: Test CI default Docker config file / Test default-conf in Docker
-    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
+    needs: build
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
 
   test-zebra-conf-path:
     name: Test CI custom Docker config file / Test custom-conf in Docker
-    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
+    needs: build
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'

From cab55bec9f5e12af6350e0d6c156dfda20cca49a Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Tue, 21 Nov 2023 06:12:53 +1000
Subject: [PATCH 12/16] Use correct skip condition

---
 .github/workflows/ci-unit-tests-docker.yml | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci-unit-tests-docker.yml b/.github/workflows/ci-unit-tests-docker.yml
index a13598d6994..466718f6df2 100644
--- a/.github/workflows/ci-unit-tests-docker.yml
+++ b/.github/workflows/ci-unit-tests-docker.yml
@@ -22,15 +22,6 @@ on:
         default: false
 
   pull_request:
-    # Skip PRs from external repositories, let them pass, and then Mergify will check them
-    branches:
-      # Include all branches
-      - '**'
-      # Exclude external repositories
-      - '!**/**'
-      # But include mergify and dependabot
-      - 'mergify/**'
-      - 'dependabot/**'
     # Skip PRs where Rust code and dependencies aren't modified.
     paths:
       # code and tests
@@ -98,6 +89,8 @@ jobs:
   # testnet when running the image.
   build:
     name: Build CI Docker
+    # Skip PRs from external repositories, let them pass, and then Mergify will check them
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     uses: ./.github/workflows/sub-build-docker-image.yml
     with:
       dockerfile_path: ./docker/Dockerfile

From 972c2966ef46da2f2b234f29fb156a210c5b51c8 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Tue, 21 Nov 2023 09:07:16 +1000
Subject: [PATCH 13/16] Make the start docs visible so we can link to them

---
 zebrad/src/commands.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/zebrad/src/commands.rs b/zebrad/src/commands.rs
index 70728ce9302..9751f8693e1 100644
--- a/zebrad/src/commands.rs
+++ b/zebrad/src/commands.rs
@@ -10,10 +10,11 @@ pub use self::{entry_point::EntryPoint, start::StartCmd};
 
 use self::{copy_state::CopyStateCmd, generate::GenerateCmd, tip_height::TipHeightCmd};
 
+pub mod start;
+
 mod copy_state;
 mod entry_point;
 mod generate;
-mod start;
 mod tip_height;
 
 #[cfg(test)]

From 0430975d4d09a4b86bed5f544bf68703a48365ff Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Tue, 21 Nov 2023 09:17:23 +1000
Subject: [PATCH 14/16] Skip integration tests on external PRs

---
 ...i-integration-tests-gcp.patch-external.yml | 101 ++++++++++++++++++
 .../ci-integration-tests-gcp.patch.yml        |   8 +-
 .../workflows/ci-integration-tests-gcp.yml    |  11 ++
 .../ci-unit-tests-docker.patch-external.yml   |  10 +-
 .../workflows/ci-unit-tests-docker.patch.yml  |   2 +-
 .github/workflows/ci-unit-tests-docker.yml    |   5 +-
 6 files changed, 128 insertions(+), 9 deletions(-)
 create mode 100644 .github/workflows/ci-integration-tests-gcp.patch-external.yml

diff --git a/.github/workflows/ci-integration-tests-gcp.patch-external.yml b/.github/workflows/ci-integration-tests-gcp.patch-external.yml
new file mode 100644
index 00000000000..5f95c4f6d41
--- /dev/null
+++ b/.github/workflows/ci-integration-tests-gcp.patch-external.yml
@@ -0,0 +1,101 @@
+# Workflow patches for skipping Google Cloud unit test CI on PRs from external repositories.
+name: Integration Tests on GCP
+
+# Run on PRs from external repositories, let them pass, and then Mergify will check them.
+# GitHub doesn't support filtering workflows by source branch names, so we have to do it for each
+# job.
+on:
+  pull_request:
+
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch.yml` and `.yml` files.
+jobs:
+  # We don't patch the testnet job, because testnet isn't required to merge (it's too unstable)
+  get-available-disks:
+    name: Check if cached state disks exist for Mainnet / Check if cached state disks exist
+    # Only run on PRs from external repositories.
+    # (github.ref is always a local branch, so this check will skip non-PRs as well.)
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  build:
+    name: Build CI Docker / Build images
+    # This dependency allows all these jobs to depend on a single condition, making it easier to
+    # change.
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-stateful-sync:
+    name: Zebra checkpoint update / Run sync-past-checkpoint test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-update-sync:
+    name: Zebra tip update / Run update-to-tip test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  checkpoints-mainnet:
+    name: Generate checkpoints mainnet / Run checkpoints-mainnet test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  lightwalletd-rpc-test:
+    name: Zebra tip JSON-RPC / Run fully-synced-rpc test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  lightwalletd-transactions-test:
+    name: lightwalletd tip send / Run lwd-send-transactions test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  get-block-template-test:
+    name: get block template / Run get-block-template test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  submit-block-test:
+    name: submit block / Run submit-block test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  lightwalletd-full-sync:
+    name: lightwalletd tip / Run lwd-full-sync test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  lightwalletd-update-sync:
+    name: lightwalletd tip update / Run lwd-update-sync test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  lightwalletd-grpc-test:
+    name: lightwalletd GRPC tests / Run lwd-grpc-wallet test
+    needs: get-available-disks
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
diff --git a/.github/workflows/ci-integration-tests-gcp.patch.yml b/.github/workflows/ci-integration-tests-gcp.patch.yml
index f671429b5bf..faef2491dde 100644
--- a/.github/workflows/ci-integration-tests-gcp.patch.yml
+++ b/.github/workflows/ci-integration-tests-gcp.patch.yml
@@ -1,7 +1,8 @@
+# Workflow patches for skipping Google Cloud integration test CI when Rust code or dependencies
+# aren't modified in a PR.
 name: Integration Tests on GCP
 
-# These jobs *don't* depend on cached Google Cloud state disks,
-# so they can be skipped when the modified files make the actual workflow run.
+# Run on PRs with unmodified code and dependency files.
 on:
   pull_request:
     paths-ignore:
@@ -25,6 +26,9 @@ on:
       - '.github/workflows/sub-find-cached-disks.yml'
       - '.github/workflows/sub-build-docker-image.yml'
 
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch-external.yml` and `.yml` files.
 jobs:
   # We don't patch the testnet job, because testnet isn't required to merge (it's too unstable)
   get-available-disks:
diff --git a/.github/workflows/ci-integration-tests-gcp.yml b/.github/workflows/ci-integration-tests-gcp.yml
index 1132762c210..32556265bb5 100644
--- a/.github/workflows/ci-integration-tests-gcp.yml
+++ b/.github/workflows/ci-integration-tests-gcp.yml
@@ -1,3 +1,5 @@
+# Google Cloud integration tests that run when Rust code or dependencies are modified,
+# but only on PRs from the ZcashFoundation/zebra repository. (External PRs are tested by mergify.)
 name: Integration Tests on GCP
 
 # Ensures that only one workflow task will run at a time. Previous builds, if
@@ -47,6 +49,7 @@ on:
         default: false
 
   pull_request:
+    # Skip PRs where Rust code and dependencies aren't modified.
     paths:
       # code and tests
       - '**/*.rs'
@@ -68,6 +71,7 @@ on:
       - '.github/workflows/sub-find-cached-disks.yml'
 
   push:
+    # Skip main branch updates where Rust code and dependencies aren't modified.
     branches:
       - main
     paths:
@@ -91,6 +95,9 @@ on:
       - '.github/workflows/sub-find-cached-disks.yml'
       - '.github/workflows/sub-build-docker-image.yml'
 
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch.yml` and `.patch-external.yml` files.
 jobs:
   # to also run a job on Mergify head branches,
   # add `|| (github.event_name == 'push' && startsWith(github.head_ref, 'mergify/merge-queue/'))`:
@@ -104,6 +111,8 @@ jobs:
   # The outputs for this job have the same names as the workflow outputs in sub-find-cached-disks.yml
   get-available-disks:
     name: Check if cached state disks exist for ${{ inputs.network || vars.ZCASH_NETWORK }}
+    # Skip PRs from external repositories, let them pass, and then Mergify will check them
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     uses: ./.github/workflows/sub-find-cached-disks.yml
     with:
       network: ${{ inputs.network || vars.ZCASH_NETWORK }}
@@ -114,6 +123,7 @@ jobs:
   # Some outputs are ignored, because we don't run those jobs on testnet.
   get-available-disks-testnet:
     name: Check if cached state disks exist for testnet
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     uses: ./.github/workflows/sub-find-cached-disks.yml
     with:
       network: 'Testnet'
@@ -125,6 +135,7 @@ jobs:
   # testnet when running the image.
   build:
     name: Build CI Docker
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     uses: ./.github/workflows/sub-build-docker-image.yml
     with:
       dockerfile_path: ./docker/Dockerfile
diff --git a/.github/workflows/ci-unit-tests-docker.patch-external.yml b/.github/workflows/ci-unit-tests-docker.patch-external.yml
index f314a92306c..759a484da2d 100644
--- a/.github/workflows/ci-unit-tests-docker.patch-external.yml
+++ b/.github/workflows/ci-unit-tests-docker.patch-external.yml
@@ -1,8 +1,9 @@
-# Workflow patches for skipping Google Cloud CI on PRs from external repositories.
+# Workflow patches for skipping Google Cloud unit test CI on PRs from external repositories.
 name: Docker Unit Tests
 
 # Run on PRs from external repositories, let them pass, and then Mergify will check them.
-# GitHub doesn't support filtering workflows by source branch names, so we have to do it for each job.
+# GitHub doesn't support filtering workflows by source branch names, so we have to do it for each
+# job.
 on:
   pull_request:
 
@@ -12,7 +13,7 @@ on:
 jobs:
   build:
     name: Build CI Docker / Build images
-    # Only run on PRs from external repositories. 
+    # Only run on PRs from external repositories.
     # (github.ref is always a local branch, so this check will skip non-PRs as well.)
     if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
     runs-on: ubuntu-latest
@@ -21,7 +22,8 @@ jobs:
 
   test-all:
     name: Test all
-    # This dependency allows all these jobs to depend on a single condition, making it easier to change.
+    # This dependency allows all these jobs to depend on a single condition, making it easier to
+    # change.
     needs: build
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/ci-unit-tests-docker.patch.yml b/.github/workflows/ci-unit-tests-docker.patch.yml
index 633752485cd..a485f3155a1 100644
--- a/.github/workflows/ci-unit-tests-docker.patch.yml
+++ b/.github/workflows/ci-unit-tests-docker.patch.yml
@@ -1,4 +1,4 @@
-# Workflow patches for skipping CI when Rust code and dependencies aren't modified in a PR.
+# Workflow patches for skipping unit test CI when Rust code or dependencies aren't modified in a PR.
 name: Docker Unit Tests
 
 # Run on PRs with unmodified code and dependency files.
diff --git a/.github/workflows/ci-unit-tests-docker.yml b/.github/workflows/ci-unit-tests-docker.yml
index 466718f6df2..309f05868d0 100644
--- a/.github/workflows/ci-unit-tests-docker.yml
+++ b/.github/workflows/ci-unit-tests-docker.yml
@@ -1,4 +1,5 @@
-# Google Cloud CI that runs when Rust code and dependencies are modified in a PR from the ZcashFoundation/zebra repository.
+# Google Cloud unit tests that run when Rust code or dependencies are modified,
+# but only on PRs from the ZcashFoundation/zebra repository. (External PRs are tested by mergify.)
 name: Docker Unit Tests
 
 # Ensures that only one workflow task will run at a time. Previous builds, if
@@ -46,7 +47,7 @@ on:
   push:
     branches:
       - main
-    # Skip main branch merges where Rust code and dependencies aren't modified.
+    # Skip main branch updates where Rust code and dependencies aren't modified.
     paths:
       # code and tests
       - '**/*.rs'

From cc43144491bea206a153eac3b4a3449d59dec676 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Tue, 21 Nov 2023 19:07:07 +1000
Subject: [PATCH 15/16] Allow external PRs to pass CD Docker tests

---
 .../cd-deploy-nodes-gcp.patch-external.yml    | 37 +++++++++++++++++++
 .../workflows/cd-deploy-nodes-gcp.patch.yml   |  9 ++++-
 .github/workflows/cd-deploy-nodes-gcp.yml     | 11 ++++++
 3 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/cd-deploy-nodes-gcp.patch-external.yml

diff --git a/.github/workflows/cd-deploy-nodes-gcp.patch-external.yml b/.github/workflows/cd-deploy-nodes-gcp.patch-external.yml
new file mode 100644
index 00000000000..b990f9b915e
--- /dev/null
+++ b/.github/workflows/cd-deploy-nodes-gcp.patch-external.yml
@@ -0,0 +1,37 @@
+# Workflow patches for skipping Google Cloud CD deployments on PRs from external repositories.
+name: Deploy Nodes to GCP
+
+# Run on PRs from external repositories, let them pass, and then Mergify will check them.
+# GitHub doesn't support filtering workflows by source branch names, so we have to do it for each
+# job.
+on:
+  pull_request:
+
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch.yml` and `.yml` files.
+jobs:
+  # We don't patch the testnet job, because testnet isn't required to merge (it's too unstable)
+  build:
+    name: Build CD Docker / Build images
+    # Only run on PRs from external repositories, skipping ZF branches and tags.
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') && !contains(github.head_ref || github.ref, 'refs/tags/') }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-configuration-file:
+    name: Test CD default Docker config file / Test default-conf in Docker
+    # This dependency allows all these jobs to depend on a single condition, making it easier to
+    # change.
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  test-zebra-conf-path:
+    name: Test CD custom Docker config file / Test custom-conf in Docker
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
diff --git a/.github/workflows/cd-deploy-nodes-gcp.patch.yml b/.github/workflows/cd-deploy-nodes-gcp.patch.yml
index 457bedc2a3b..ed4c6afbc85 100644
--- a/.github/workflows/cd-deploy-nodes-gcp.patch.yml
+++ b/.github/workflows/cd-deploy-nodes-gcp.patch.yml
@@ -1,5 +1,8 @@
+# Workflow patches for skipping Google Cloud CD deployments, when Rust code or dependencies aren't
+# modified in a PR.
 name: Deploy Nodes to GCP
 
+# Run on PRs with unmodified code and dependency files.
 on:
   pull_request:
    paths-ignore:
@@ -19,7 +22,11 @@ on:
      - '.github/workflows/cd-deploy-nodes-gcp.yml'
      - '.github/workflows/sub-build-docker-image.yml'
 
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch-external.yml` and `.yml` files.
 jobs:
+  # We don't patch the testnet job, because testnet isn't required to merge (it's too unstable)
   build:
     name: Build CD Docker / Build images
     runs-on: ubuntu-latest
@@ -36,4 +43,4 @@ jobs:
     name: Test CD custom Docker config file / Test custom-conf in Docker
     runs-on: ubuntu-latest
     steps:
-      - run: 'echo "No build required"'
\ No newline at end of file
+      - run: 'echo "No build required"'
diff --git a/.github/workflows/cd-deploy-nodes-gcp.yml b/.github/workflows/cd-deploy-nodes-gcp.yml
index 9cf6a274728..a6be4cbb4c4 100644
--- a/.github/workflows/cd-deploy-nodes-gcp.yml
+++ b/.github/workflows/cd-deploy-nodes-gcp.yml
@@ -1,3 +1,6 @@
+# Google Cloud node deployments and tests that run when Rust code or dependencies are modified,
+# but only on PRs from the ZcashFoundation/zebra repository.
+# (External PRs are tested/deployed by mergify.)
 name: Deploy Nodes to GCP
 
 # Ensures that only one workflow task will run at a time. Previous deployments, if
@@ -31,6 +34,7 @@ on:
 
   # TODO: Temporarily disabled to reduce network load, see #6894.
   #push:
+  #  # Skip main branch updates where Rust code and dependencies aren't modified.
   #  branches:
   #    - main
   #  paths:
@@ -52,6 +56,7 @@ on:
 
   # Only runs the Docker image tests, doesn't deploy any instances
   pull_request:
+    # Skip PRs where Rust code and dependencies aren't modified.
     paths:
       # code and tests
       - '**/*.rs'
@@ -73,6 +78,9 @@ on:
     types:
       - published
 
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch.yml` and `.patch-external.yml` files.
 jobs:
   # If a release was made we want to extract the first part of the semver from the
   # tag_name
@@ -107,6 +115,9 @@ jobs:
   # The image will be commonly named `zebrad:<short-hash | github-ref | semver>`
   build:
     name: Build CD Docker
+    # Skip PRs from external repositories, let them pass, and then Mergify will check them.
+    # Since this workflow also runs on release tags, we need to check for them as well.
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') || contains(github.head_ref || github.ref, 'refs/tags/') }}
     uses: ./.github/workflows/sub-build-docker-image.yml
     with:
       dockerfile_path: ./docker/Dockerfile

From bcbf42a681d54499a83e15207b43cc5039c5ca95 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Tue, 21 Nov 2023 19:14:13 +1000
Subject: [PATCH 16/16] Allow external PRs to pass Docs build and deploy

---
 .../docs-deploy-firebase.patch-external.yml   | 30 +++++++++++++++++++
 .../workflows/docs-deploy-firebase.patch.yml  |  9 ++++--
 .github/workflows/docs-deploy-firebase.yml    | 13 ++++++--
 3 files changed, 47 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/docs-deploy-firebase.patch-external.yml

diff --git a/.github/workflows/docs-deploy-firebase.patch-external.yml b/.github/workflows/docs-deploy-firebase.patch-external.yml
new file mode 100644
index 00000000000..706f24d694c
--- /dev/null
+++ b/.github/workflows/docs-deploy-firebase.patch-external.yml
@@ -0,0 +1,30 @@
+# Workflow patches for skipping Google Cloud docs updates on PRs from external repositories.
+name: Docs
+
+# Run on PRs from external repositories, let them pass, and then Mergify will check them.
+# GitHub doesn't support filtering workflows by source branch names, so we have to do it for each
+# job.
+on:
+  pull_request:
+
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch.yml` and `.yml` files.
+jobs:
+  build-docs-book:
+    name: Build and Deploy Zebra Book Docs
+    # Only run on PRs from external repositories.
+    # (github.ref is always a local branch, so this check will skip non-PRs as well.)
+    if: ${{ !contains(github.head_ref || github.ref, 'refs/heads/') }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  build-docs-internal:
+    name: Build and Deploy Zebra Internal Docs
+    # This dependency allows all these jobs to depend on a single condition, making it easier to
+    # change.
+    needs: build-docs-book
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
diff --git a/.github/workflows/docs-deploy-firebase.patch.yml b/.github/workflows/docs-deploy-firebase.patch.yml
index 4f6a0c2db8f..ed8bba560b5 100644
--- a/.github/workflows/docs-deploy-firebase.patch.yml
+++ b/.github/workflows/docs-deploy-firebase.patch.yml
@@ -1,9 +1,10 @@
+# Workflow patches for skipping Google Cloud docs updates when docs, Rust code, or dependencies
+# aren't modified in a PR.
 name: Docs
 
+# Run on PRs with unmodified docs, code, and dependency files.
 on:
   pull_request:
-    branches:
-      - main
     paths-ignore:
       # doc source files
       - 'book/**'
@@ -20,6 +21,9 @@ on:
       # workflow definitions
       - '.github/workflows/docs-deploy-firebase.yml'
 
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch-external.yml` and `.yml` files.
 jobs:
   build-docs-book:
     name: Build and Deploy Zebra Book Docs
@@ -29,7 +33,6 @@ jobs:
 
   build-docs-internal:
     name: Build and Deploy Zebra Internal Docs
-    timeout-minutes: 45
     runs-on: ubuntu-latest
     steps:
       - run: 'echo "No build required"'
diff --git a/.github/workflows/docs-deploy-firebase.yml b/.github/workflows/docs-deploy-firebase.yml
index e6d0220dcba..f81e48bc263 100644
--- a/.github/workflows/docs-deploy-firebase.yml
+++ b/.github/workflows/docs-deploy-firebase.yml
@@ -1,3 +1,5 @@
+# Google Cloud docs updates that run when docs, Rust code, or dependencies are modified,
+# but only on PRs from the ZcashFoundation/zebra repository. (External PRs are deployed by mergify.)
 name: Docs
 
 # Ensures that only one workflow task will run at a time. Previous deployments, if
@@ -9,7 +11,9 @@ concurrency:
 
 on:
   workflow_dispatch:
+
   push:
+    # Skip main branch updates where docs, Rust code, and dependencies aren't modified.
     branches:
       - main
     paths:
@@ -29,8 +33,7 @@ on:
       - '.github/workflows/docs-deploy-firebase.yml'
 
   pull_request:
-    branches:
-      - main
+    # Skip PRs where docs, Rust code, and dependencies aren't modified.
     paths:
       # doc source files
       - 'book/**'
@@ -60,9 +63,14 @@ env:
   # https://github.com/ZcashFoundation/zebra/blob/main/.cargo/config.toml#L87
   RUSTDOCFLAGS: --html-in-header katex-header.html -D warnings -A rustdoc::private_intra_doc_links
 
+# IMPORTANT
+#
+# These job names must be kept in sync with the `.patch.yml` and `.patch-external.yml` files.
 jobs:
   build-docs-book:
     name: Build and Deploy Zebra Book Docs
+    # Skip PRs from external repositories, let them pass, and then Mergify will check them
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     timeout-minutes: 5
     runs-on: ubuntu-latest
     permissions:
@@ -116,6 +124,7 @@ jobs:
 
   build-docs-internal:
     name: Build and Deploy Zebra Internal Docs
+    if: ${{ contains(github.head_ref || github.ref, 'refs/heads/') }}
     timeout-minutes: 45
     runs-on: ubuntu-latest
     permissions: