vikin91 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026 · Oct 16, 2026 · Oct 16, 2026
@@ -0,0 +1,12 @@
+name: Build CI selector
+description: Build the Go CI selection prototype before gated setup steps
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # ratchet:actions/setup-go@v6
+      with:
+        go-version-file: go.mod
+        cache: false
+    - name: Build CI selector
+      shell: bash
+      run: ci/select/build.sh
@@ -35,36 +35,60 @@ jobs:
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.sha }}
 
+    - name: Build CI selector
+      if: github.event_name == 'pull_request'
+      continue-on-error: true
+      uses: ./.github/actions/ci-select
+
+    - name: Read the CI decision
+      id: ci-decision
+      if: github.event_name == 'pull_request'
+      env:
+        CI_ENFORCE: ${{ contains(github.event.pull_request.labels.*.name, 'ci-dispatcher-enforce') }}
+        CI_REPO: ${{ github.repository }}
+        CI_PR: ${{ github.event.pull_request.number }}
+        CI_COMMIT: ${{ github.event.pull_request.head.sha }}
+        CI_BASE: ${{ github.event.pull_request.base.sha }}
+        CI_HEAD: ${{ github.event.pull_request.head.sha }}
+        PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+      run: ci/select/gha-gate.sh check-crd-compatibility
+
     - uses: ./.github/actions/job-preamble
+      if: steps.ci-decision.outputs.action != 'skip'
       with:
         gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
 
     - name: Checkout crd-schema-checker
+      if: steps.ci-decision.outputs.action != 'skip'
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
       with:
         repository: openshift/crd-schema-checker
         path: .crd-schema-checker
         ref: c313b6407231f6d1aabfb602f0823708f8c6b9fb # 2025-09-05
 
     - name: Build crd-schema-checker
+      if: steps.ci-decision.outputs.action != 'skip'
       run: |
         make -C .crd-schema-checker
 
     - name: Get previous released version
+      if: steps.ci-decision.outputs.action != 'skip'
       id: get_previous_released_version
       run: |
         make -C operator bundle-post-process
         released_version="$(make --no-print-directory -C operator replaced-version)"
         echo "released_version=$released_version" >> "$GITHUB_OUTPUT"
 
     - name: Checkout previous released version
+      if: steps.ci-decision.outputs.action != 'skip'
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
       with:
         fetch-depth: 0
         ref: ${{ steps.get_previous_released_version.outputs.released_version }}
         path: .old-stackrox
 
     - name: Run crd-schema-checker for platform operator
+      if: steps.ci-decision.outputs.action != 'skip'
       run: |
         set -e
         old_path=.old-stackrox/operator/config/crd/bases
@@ -77,6 +101,7 @@ jobs:
         .crd-schema-checker/crd-schema-checker check-manifests $args --existing-crd-filename=$old_path/$central_file --new-crd-filename=$new_path/$central_file
 
     - name: Run crd-schema-checker for config operator
+      if: steps.ci-decision.outputs.action != 'skip'
       run: |
         set -e
         old_path=.old-stackrox/config-controller/config/crd/bases
@@ -87,6 +112,7 @@ jobs:
         .crd-schema-checker/crd-schema-checker check-manifests $args --existing-crd-filename=$old_path/$policy_file --new-crd-filename=$new_path/$policy_file
 
     - name: Run crdify for platform operator
+      if: steps.ci-decision.outputs.action != 'skip'
       run: |
         set -euo pipefail
         old_path="$PWD/.old-stackrox/operator/config/crd/bases"
@@ -96,6 +122,7 @@ jobs:
         $crdify "${old_path}/platform.stackrox.io_centrals.yaml" "${new_path}/platform.stackrox.io_centrals.yaml"
 
     - name: Run crdify for config operator
+      if: steps.ci-decision.outputs.action != 'skip'
       run: |
         set -euo pipefail
         old_path="$PWD/.old-stackrox/config-controller/config/crd/bases"

@@ -0,0 +1,40 @@
+name: CI decision
+
+# Prints the decision for a pull request. It does not start or stop other
+# jobs. The label ci-dispatcher-enforce is read by the jobs that follow
+# the decision.
+
+on:
+  pull_request:
+    types:
+    - opened
+    - reopened
+    - synchronize
+    - labeled
+    - unlabeled
+
+permissions:
+  contents: read
+
+jobs:
+  decision:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - uses: ./.github/actions/ci-select
+
+      - name: Print the CI decision
+        env:
+          CI_ENFORCE: ${{ contains(github.event.pull_request.labels.*.name, 'ci-dispatcher-enforce') }}
+          CI_REPO: ${{ github.repository }}
+          CI_PR: ${{ github.event.pull_request.number }}
+          CI_COMMIT: ${{ github.event.pull_request.head.sha }}
+          CI_BASE: ${{ github.event.pull_request.base.sha }}
+          CI_HEAD: ${{ github.event.pull_request.head.sha }}
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+        run: ci/select/gha-gate.sh
@@ -0,0 +1,46 @@
+name: CI selector tests
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+  push:
+    branches: [master, 'release-*']
+
+permissions:
+  contents: read
+
+jobs:
+  selector-tests:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Build CI selector
+        continue-on-error: true
+        uses: ./.github/actions/ci-select
+
+      - name: Read the CI decision
+        id: ci-decision
+        if: github.event_name == 'pull_request'
+        env:
+          CI_ENFORCE: ${{ contains(github.event.pull_request.labels.*.name, 'ci-dispatcher-enforce') }}
+          CI_REPO: ${{ github.repository }}
+          CI_PR: ${{ github.event.pull_request.number }}
+          CI_COMMIT: ${{ github.event.pull_request.head.sha }}
+          CI_BASE: ${{ github.event.pull_request.base.sha }}
+          CI_HEAD: ${{ github.event.pull_request.head.sha }}
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+        run: ci/select/gha-gate.sh selector-tests
+
+      - name: Test CI selector
+        if: steps.ci-decision.outputs.action != 'skip'
+        run: go test -race ./ci/select
+
+      - name: Validate CI rules
+        if: steps.ci-decision.outputs.action != 'skip'
+        run: ci/select/bin/ci-select validate
@@ -13,6 +13,8 @@ on:
     - reopened
     - synchronize
     - ready_for_review
+    - labeled
+    - unlabeled
 
 permissions:
   contents: read
@@ -30,108 +32,50 @@ jobs:
   # This allows to skip running E2E tests on draft PRs without corresponding labels or on untrusted forks.
   should-dispatch:
     needs: [ detect-changes ]
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
     outputs:
       wait-for-gha-images: ${{ steps.determine.outputs.wait-for-gha-images }}
       wait-for-konflux-images: ${{ steps.determine.outputs.wait-for-konflux-images }}
       jobs: ${{ steps.determine.outputs.jobs }}
     steps:
-    - name: Determine whether should dispatch workflows
+    - name: Checkout
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
+      with:
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha || github.sha }}
+        persist-credentials: false
+
+    # TODO(ROX-37371): Decide binary distribution and recovery when the selector
+    # cannot compile or run. A prebuilt binary removes compilation failures,
+    # but dispatch still needs a fallback independent of the binary.
+    - uses: ./.github/actions/ci-select
+
+    - name: Print the CI decision
+      if: github.event_name == 'pull_request'
+      env:
+        CI_ENFORCE: ${{ contains(github.event.pull_request.labels.*.name, 'ci-dispatcher-enforce') }}
+        CI_REPO: ${{ github.repository }}
+        CI_PR: ${{ github.event.pull_request.number }}
+        CI_COMMIT: ${{ github.event.pull_request.head.sha }}
+        CI_BASE: ${{ github.event.pull_request.base.sha }}
+        CI_HEAD: ${{ github.event.pull_request.head.sha }}
+        PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+      run: ci/select/gha-gate.sh
+
+    - name: Determine whether to dispatch workflows
       id: determine
-      shell: python
       env:
         GH_TOKEN: ${{ github.token }}
-        PYTHONUNBUFFERED: "1"
-        input__event_name: ${{ github.event_name }}
-        input__is_fork: ${{ github.event.pull_request.head.repo.fork }}
-        input__is_draft: ${{ github.event.pull_request.draft }}
-        input__ui_only_change: ${{ needs.detect-changes.outputs.ui_only }}
-        input__repo: ${{ github.repository }}
-        input__pr_number: ${{ github.event.pull_request.number }}
-      run: |
-        import json
-        import os
-        import subprocess
-        from types import SimpleNamespace
-        from dataclasses import dataclass
-
-        @dataclass
-        class Job:
-            name: str
-            require_pr_label: bool = False
-            require_konflux_build: bool = False
-
-            def should_run(self, input):
-                if input.is_fork == 'true':
-                    return False
-
-                if input.event_name != 'pull_request':
-                    return True
-                elif self.name in input.pr_labels:
-                    return True
-
-                # We are in a PR context, job is not explicitly listed among the PR labels.
-
-                # TODO(ROX-21073): re-enable Konflux for all PR branches
-                if self.require_konflux_build and 'konflux-build' not in input.pr_labels:
-                    return False
-
-                if input.ui_only_change == 'true':
-                    # For now, all the workflows that we dispatch should be skipped for PRs that only change UI.
-                    # As we add more E2E test workflows, we may want to make this more flexible.
-                    return False
-                if self.require_pr_label:
-                    return False
-                if input.is_draft != 'true':
-                    return True
-
-                return False
-
-
-        input = SimpleNamespace(**{
-            key.removeprefix('input__'): val
-            for (key, val) in os.environ.items()
-            if key.startswith('input__')})
-
-        if input.event_name != 'pull_request':
-            input.pr_labels = []
-        else:
-            p = subprocess.run(
-                ['gh', 'pr', 'view', input.pr_number, '--repo', input.repo, '--json', 'labels', '--jq', '.labels[].name'],
-                check=True, encoding='utf-8', stdout=subprocess.PIPE, stdin=subprocess.DEVNULL)
-            input.pr_labels = p.stdout.strip().splitlines()
-
-        for k, v in vars(input).items():
-            print(f'{k} = {v}')
-
-        jobs_registry = [
-            Job(name='e2e-byodb-tests', require_pr_label=True),
-            Job(name='e2e-db-backup-restore-tests'),
-            Job(name='e2e-gke-upgrade-tests'),
-            Job(name='e2e-nongroovy-tests-gke'),
-            Job(name='e2e-nongroovy-tests-gke-konflux', require_konflux_build=True),
-            Job(name='e2e-qa-tests-gke', require_pr_label=True),
-            Job(name='e2e-qa-tests-gke-konflux', require_konflux_build=True),
-            Job(name='e2e-qa-tests-ocp-fips-konflux', require_konflux_build=True),
-        ]
-
-        with open(os.environ['GITHUB_OUTPUT'], mode='at', encoding='utf-8') as file:
-            def write(job, val):
-                line = f'{job}={val}'
-                print(line)
-                file.write(line + '\n')
-
-            jobs = {job.name: job.should_run(input) for job in jobs_registry}
-
-            write('jobs', json.dumps(jobs))
-
-            # Find out when we can complete the workflow early by not even waiting for GHA-built images.
-            wait_for_gha_images = input.event_name != 'pull_request' or input.is_draft != 'true' or any(jobs.values())
-            write('wait-for-gha-images', str(wait_for_gha_images).lower())
-
-            # Waiting for konflux-built images in PR request context requires the 'konflux-build' PR label.
-            wait_for_konflux_images = input.event_name != 'pull_request' or ('konflux-build' in input.pr_labels and any(jobs.values()))
-            write('wait-for-konflux-images', str(wait_for_konflux_images).lower())
+        CI_REPO: ${{ github.repository }}
+        CI_PR: ${{ github.event.pull_request.number }}
+        CI_COMMIT: ${{ github.event.pull_request.head.sha }}
+        CI_BASE: ${{ github.event.pull_request.base.sha }}
+        CI_HEAD: ${{ github.event.pull_request.head.sha }}
+        CI_IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
+        CI_IS_DRAFT: ${{ github.event.pull_request.draft }}
+        CI_UI_ONLY: ${{ needs.detect-changes.outputs.ui_only }}
+        PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+      run: ci/select/bin/ci-select gha-dispatch-ci
 
   wait-for-images:
     needs: [ should-dispatch ]

@@ -28,21 +28,45 @@ jobs:
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0
       with:
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
+
+    - name: Build CI selector
+      if: github.event_name == 'pull_request'
+      continue-on-error: true
+      uses: ./.github/actions/ci-select
+
+    - name: Read the CI decision
+      id: ci-decision
+      if: github.event_name == 'pull_request'
+      env:
+        CI_ENFORCE: ${{ contains(github.event.pull_request.labels.*.name, 'ci-dispatcher-enforce') }}
+        CI_REPO: ${{ github.repository }}
+        CI_PR: ${{ github.event.pull_request.number }}
+        CI_COMMIT: ${{ github.event.pull_request.head.sha }}
+        CI_BASE: ${{ github.event.pull_request.base.sha }}
+        CI_HEAD: ${{ github.event.pull_request.head.sha }}
+        PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+      run: ci/select/gha-gate.sh db-integration-tests
 
     - uses: ./.github/actions/job-preamble
+      if: steps.ci-decision.outputs.action != 'skip'
       with:
         gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
 
     - name: Run Postgres
+      if: steps.ci-decision.outputs.action != 'skip'
       run: |
         su postgres -c 'initdb -D /tmp/data'
         su postgres -c 'pg_ctl -D /tmp/data start'
 
     - name: Cache Go dependencies
+      if: steps.ci-decision.outputs.action != 'skip'
       uses: ./.github/actions/cache-go-dependencies
 
     - name: Is Postgres ready
+      if: steps.ci-decision.outputs.action != 'skip'
       run: pg_isready -h 127.0.0.1
 
     - name: DB Integration tests
+      if: steps.ci-decision.outputs.action != 'skip'
       run: make -C scanner db-integration-test