ci: Automate dependabot merges

We currently run many different workflows for each PR, each flagged on a subset
of files. This means that we can't mark any workflows as required for PRs to
merge, which in turn limits our ability to automate the merge process for
dependencies.

To fix this, we consolidate our various integration testing steps into a single
Pull Request workflow (which will be marked as required for PRs to merge).

Similarly, the coverage workflow now runs on on all PRs; and we use the
changed-files action to limit execution to changes that alter Rust code.

All workflows are updated to use GitHub's native concurrency control, which
replaces styfle/cancel-workflow-action.

.github/list-crates.sh

@@ -19,28 +19,21 @@ find_manifest() {
 
 # Build an expression to match all changed manifests.
 manifest_expr() {
-    expr=false
-
+    printf '%s' 'false'
     for file in "$@" ; do
-        # If the workflow changes or root Cargo.toml changes, run checks for all crates in the repo.
-        if [[ "$file" = .github/* ]] || [ "$file" = "Cargo.toml" ]; then
-            expr="startswith(\"$PWD\")"
-            break
-        fi
-
-        # Otherwise, only run checks for changes to subcrates (and not the top-level crate).
         m=$(find_manifest "$file")
         if [ "$m" != "Cargo.toml" ]; then
-            expr="$expr or (. == \"$m\")"
+            printf ' or (. == "%s")' "$m"
         fi
     done
-
-    echo "$expr"
+    printf '\n'
 }
 
+expr=$(manifest_expr "$@")
+
 # Get the crate names for all changed manifest directories.
 crates=$(cargo metadata --locked --format-version=1 \
-    | jq -cr "[.packages[] | select(.manifest_path | $(manifest_expr "$@")) | .name]")
+    | jq -cr "[.packages[] | select(.manifest_path | $expr) | .name]")
 
 echo "crates=$crates" >> "$GITHUB_OUTPUT"
 echo "$crates" | jq .

.github/workflows/coverage.yml

@@ -1,21 +1,18 @@
 name: coverage
 
-permissions:
-  contents: read
-
 on:
   # We run coverage on main so that PRs can have a meaninful comparison that
   # doesn't lag a whole day.
   push:
-    branches:
-      - main
+    branches: [main]
+  pull_request: {}
+
+permissions:
+  contents: read
 
-  # Coverage runs on all code changes (as well as changes to the workflow).
-  pull_request:
-    paths:
-      - .codecov.yml
-      - .github/workflows/coverage.yml
-      - '**/*.rs'
+concurrency:
+  group:  ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
 
 env:
   CARGO_INCREMENTAL: 0
@@ -24,20 +21,25 @@ env:
   RUSTUP_MAX_RETRIES: 10
 
 jobs:
-  # Cancel any previous runs of this workflow so coverage runs don't back up,
-  # especially on main (i.e. after merging several PRs).
-  cleanup:
+  meta:
+    timeout-minutes: 5
     runs-on: ubuntu-latest
-    permissions:
-      actions: write
     steps:
-      - uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa
+      - id: changed
+        uses: tj-actions/changed-files@800a2825992141ddde1a8bca8ad394cec34d3188
         with:
-          all_but_latest: true
-          access_token: ${{ github.token }}
+          files: |
+            .codecov.yml
+            .github/workflows/coverage.yml
+            **/*.rs
+          ignore_files: |
+            *-proto/**
+    outputs:
+      any_changed: ${{ steps.changed.outputs.any_changed }}
 
-  test:
-    name: codecov
+  codecov:
+    needs: meta
+    if: github.event_name == 'push' || needs.meta.outputs.any_changed
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container: