ci: let fork PRs enter the merge queue (skip e2e on forks, keep unit+coverage)

Fork PRs could not enter the merge queue. The required `coverage` check
`needs: [unit-test, e2e-test]`, but `e2e-test` uses the azure-prod environment
and warehouse secrets that GitHub withholds from a fork's pull_request run — so
e2e-test can't pass on a fork, coverage is skipped, and the required coverage
check never posts on the fork head, leaving the PR permanently BLOCKED.

Skip e2e on fork PRs only; keep unit-test and coverage running everywhere:
- e2e-test: `if: github.event.pull_request.head.repo.fork != true`. Runs on
  internal PRs, push, and merge_group (no fork context there); skipped on forks.
  A fork's code is still e2e-tested in the merge queue before it can merge.
- coverage: `if: !cancelled() && needs.unit-test.result == 'success' &&
  needs.e2e-test.result != 'failure'` so a SKIPPED e2e (forks) doesn't auto-skip
  coverage, while a genuine e2e FAILURE still blocks it (no regression).
- codecov upload step: gated to non-forks (CODECOV_TOKEN is absent on forks and
  fail_ci_if_error would fail the required check); the report still generates
  from unit-test artifacts, only the external upload is skipped.

Result: fork PRs run unit-test + coverage → coverage posts success → they can
auto-enqueue; the real e2e suite runs in the merge queue.

Co-authored-by: Isaac
Signed-off-by: eric-wang-1990 <115501094+eric-wang-1990@users.noreply.github.com>

Author: eric-wang-1990

.github/workflows/main.yml

@@ -101,6 +101,15 @@ jobs:
           retention-days: 1
 
   e2e-test:
+    # Skip on fork PRs only: e2e needs the azure-prod environment + warehouse
+    # secrets, which GitHub withholds from a fork's pull_request run — so it
+    # can't pass there and would otherwise permanently block the required
+    # `coverage` check (which needs this job), keeping fork PRs out of the merge
+    # queue. On internal PRs, push, and merge_group there is no
+    # `pull_request.head.repo.fork == true`, so this runs normally — a fork PR's
+    # code is still e2e-tested in the merge queue (base-repo context, secrets
+    # available) before it can merge.
+    if: ${{ github.event.pull_request.head.repo.fork != true }}
     runs-on:
       group: databricks-protected-runner-group
       labels: linux-ubuntu-latest
@@ -162,6 +171,12 @@ jobs:
 
   coverage:
     needs: [unit-test, e2e-test]
+    # Run whenever unit-test passed, tolerating a SKIPPED e2e-test (fork PRs,
+    # where e2e is skipped above). A default `needs` would auto-skip coverage
+    # when e2e is skipped, leaving this required check absent on fork heads and
+    # blocking the merge queue. A genuine e2e FAILURE (internal PR / merge_group)
+    # still blocks coverage — e2e stays enforced everywhere it can run.
+    if: ${{ !cancelled() && needs.unit-test.result == 'success' && needs.e2e-test.result != 'failure' }}
     runs-on:
       group: databricks-protected-runner-group
       labels: linux-ubuntu-latest
@@ -188,7 +203,12 @@ jobs:
           ls -1 coverage_*.tar | xargs -I '{}' -- tar -xvf '{}'
           rm coverage_*.tar
       - run: ls -la
+      # Upload to Codecov only when the token is available (non-fork). Forks
+      # can't access CODECOV_TOKEN, and with fail_ci_if_error the step would
+      # fail the required coverage check on forks. The report still generates
+      # from the unit-test artifacts; only the external upload is skipped.
       - name: Coverage
+        if: ${{ github.event.pull_request.head.repo.fork != true }}
         uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}