chore: run CI on forks

.github/workflows/build_and_test.yml

@@ -0,0 +1,101 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Reusable orchestrator — invoked by build_main.yml's `call-build-and-test`
+# job. Filename, workflow name, and the precondition's job name are chosen
+# to match apache/spark exactly so the rendered check names follow the same
+# pattern (e.g. "Run / Check changes").
+#
+# Unlike Spark's build_and_test.yml, which inlines every test job, Comet
+# fans out to per-area workflows via `workflow_call`. The per-area
+# workflows (pr_build_linux.yml, pr_build_macos.yml, etc.) remain
+# independently invocable via workflow_dispatch.
+
+name: Build and test
+
+on:
+  workflow_call:
+
+jobs:
+  # Lightweight marker job. Its display name "Check changes" combined with
+  # the "Run" wrapper job in build_main.yml produces the check name
+  # "Run / Check changes" that notify_test_workflow.yml deep-links to.
+  precondition:
+    name: Check changes
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+
+  build-linux:
+    name: PR Build (Linux)
+    needs: precondition
+    uses: ./.github/workflows/pr_build_linux.yml
+
+  build-macos:
+    name: PR Build (macOS)
+    needs: precondition
+    uses: ./.github/workflows/pr_build_macos.yml
+
+  spark-sql:
+    name: Spark SQL Tests
+    needs: precondition
+    uses: ./.github/workflows/spark_sql_test.yml
+
+  spark-sql-iceberg:
+    name: Spark SQL (native Iceberg)
+    needs: precondition
+    uses: ./.github/workflows/spark_sql_test_native_iceberg_compat.yml
+
+  iceberg-spark:
+    name: Iceberg Spark
+    needs: precondition
+    uses: ./.github/workflows/iceberg_spark_test.yml
+
+  miri:
+    name: Miri
+    needs: precondition
+    uses: ./.github/workflows/miri.yml
+
+  # Lightweight policy / lint checks. These ran on `pull_request:` directly
+  # against apache/datafusion-comet before the fork-CI migration; they now
+  # run on the fork like the heavy jobs above. (CodeQL is intentionally not
+  # listed — it stays on the upstream `pull_request:` trigger so that
+  # security findings continue to surface in apache's Security tab.)
+  rat-check:
+    name: RAT License Check
+    needs: precondition
+    uses: ./.github/workflows/pr_rat_check.yml
+
+  markdown-format:
+    name: Markdown Format
+    needs: precondition
+    uses: ./.github/workflows/pr_markdown_format.yml
+
+  missing-suites:
+    name: Missing Suites
+    needs: precondition
+    uses: ./.github/workflows/pr_missing_suites.yml
+
+  validate-workflows:
+    name: Validate Workflows
+    needs: precondition
+    uses: ./.github/workflows/validate_workflows.yml
+
+  benchmark-check:
+    name: Benchmark Check
+    needs: precondition
+    uses: ./.github/workflows/pr_benchmark_check.yml

.github/workflows/build_main.yml

@@ -0,0 +1,75 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Fork-side entry workflow.
+#
+# Mirrors apache/spark's build_main.yml + build_and_test.yml split exactly:
+# this is a thin wrapper that fires on every branch push in a contributor's
+# fork. Its single `call-build-and-test` job (display name "Run") delegates
+# to build_and_test.yml, so the rendered check names follow Spark's
+# convention — e.g. "Run / Check changes" for the precondition.
+#
+# The upstream apache/datafusion-comet repo detects this run via
+# notify_test_workflow.yml and surfaces its status as a "Build" check on
+# the PR; update_build_status.yml polls and syncs the check.
+#
+# COUPLING — keep the following in sync if this file is renamed or
+# restructured:
+#   - notify_test_workflow.yml looks up runs by file id 'build_main.yml'.
+#   - notify_test_workflow.yml deep-links to a check named
+#     "Run / Check changes": "Run" is the display name of the
+#     `call-build-and-test` job below, "Check changes" is the display name
+#     of the `precondition` job in build_and_test.yml.
+#
+# The workflow name "Build" is intentionally generic to match Spark's
+# convention — GitHub's check-suite-from-workflow mapping picks an arbitrary
+# associated workflow when creating a check run.
+# See https://github.community/t/specify-check-suite-when-creating-a-checkrun/118380/10
+
+name: Build
+
+concurrency:
+  # Cancel in-flight runs on the same ref when a newer commit lands. Without
+  # this, repeated pushes to a PR branch pile up parallel runs of the entire
+  # pipeline. The per-area workflows declare their own concurrency groups,
+  # but those only apply to direct triggers — they do not cancel jobs invoked
+  # via workflow_call from this workflow, since those run inside this run.
+  group: build-main-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  # Match Spark exactly: trigger on every branch push with no path filter.
+  # build_and_test.yml fans out to lightweight checks (rat, markdown,
+  # benchmark, missing-suites, validate-workflows) as well as the heavy
+  # build/test jobs, and the upstream "Build" check is created from any
+  # detected fork run — so any path-based skip here would leave PRs
+  # touching only those paths in a permanently-pending check state.
+  push:
+    branches:
+      - '**'
+
+# Default token permissions for every job and every called reusable workflow.
+# `contents: read` is the minimum needed for actions/checkout against a
+# public repo's authenticated clone path. Any job that needs more (e.g.
+# `packages: write` for ghcr.io publishing) should declare it locally.
+permissions:
+  contents: read
+
+jobs:
+  call-build-and-test:
+    name: Run
+    uses: ./.github/workflows/build_and_test.yml

.github/workflows/iceberg_spark_test.yml

@@ -18,38 +18,15 @@
 name: Iceberg Spark SQL Tests
 
 concurrency:
-  group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
+  # Literal suffix keeps the group unique when this workflow is invoked via
+  # `workflow_call` from build_and_test.yml, since github.workflow then
+  # resolves to the caller's name.
+  group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}-iceberg
   cancel-in-progress: true
 
 on:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - "benchmarks/**"
-      - "doc/**"
-      - "docs/**"
-      - "**.md"
-      - "dev/changelog/*.md"
-      - "native/core/benches/**"
-      - "native/spark-expr/benches/**"
-      - "spark/src/test/**"
-      - "common/src/test/**"
-      - "spark/src/main/scala/org/apache/comet/GenerateDocs.scala"
-      - "spark-integration/**"
-  pull_request:
-    paths-ignore:
-      - "benchmarks/**"
-      - "doc/**"
-      - "docs/**"
-      - "**.md"
-      - "dev/changelog/*.md"
-      - "native/core/benches/**"
-      - "native/spark-expr/benches/**"
-      - "spark/src/test/**"
-      - "common/src/test/**"
-      - "spark/src/main/scala/org/apache/comet/GenerateDocs.scala"
-      - "spark-integration/**"
+  # Called by build_and_test.yml on every branch push. No inputs.
+  workflow_call:
   # manual trigger
   # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   workflow_dispatch:

.github/workflows/miri.yml

@@ -18,32 +18,15 @@
 name: Run Miri Safety Checks
 
 concurrency:
-  group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
+  # Literal suffix keeps the group unique when this workflow is invoked via
+  # `workflow_call` from build_and_test.yml, since github.workflow then
+  # resolves to the caller's name.
+  group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}-miri
   cancel-in-progress: true
 
 on:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - "doc/**"
-      - "docs/**"
-      - "**.md"
-      - "dev/changelog/*.md"
-      - "native/core/benches/**"
-      - "native/spark-expr/benches/**"
-      - "spark/src/test/scala/org/apache/spark/sql/benchmark/**"
-      - "spark/src/main/scala/org/apache/comet/GenerateDocs.scala"
-  pull_request:
-    paths-ignore:
-      - "doc/**"
-      - "docs/**"
-      - "**.md"
-      - "dev/changelog/*.md"
-      - "native/core/benches/**"
-      - "native/spark-expr/benches/**"
-      - "spark/src/test/scala/org/apache/spark/sql/benchmark/**"
-      - "spark/src/main/scala/org/apache/comet/GenerateDocs.scala"
+  # Called by build_and_test.yml on every branch push. No inputs.
+  workflow_call:
   # manual trigger
   # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   workflow_dispatch: