Repository: dbt-labs/dbt-core
Pull request: Combine integration test workflows
- Combines the integration test workflows from #3669
- splits up unit tests and code linting so it is clear what each workflow is responsible for

This PR builds on top of #3669. In #3669 there are two workflows for integration tests, one for PRs and one for pushes to release branches (so after merging PRs). I don't think there is any reason to split these up, the thing to keep in mind is that when the workflow runs for PRs using the `pull_request_target` event, the workflow will run in the context of the "target" branch of the PR. It will also run for PRs from forked repositories and allow access to secrets configured for the repository. To ensure that PRs are from trusted contributors, the integration test workflow will check for a label on the PR that is applied by someone with write access to the repository. I combined the necessary checks into one workflow for simplicity and to combat code drift.

The other change in this PR is splitting up unit and linting into separate workflow. No functional changes, purely cosmetic. I like this because you can name exactly what the workflow's goal is and the workflow "matrix" is less complex.

Problem statement:
Move CI to GitHub Actions
see title 😄 

- helpful for all of CI to be located in one place
- logs and artifacts are easily accessible for the same UI the codebase lives in
- noticeable increase in speed
- ability to control concurrency if we notice parallel test runs overloading sandbox warehouses
- a safer way to run CI for PRs from forked repos
- support for windows, macos, and ubuntu runners

Hints from issue discussion:

Commit message: split up lint and unit workflows for clear resposibilites

Patch to review:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 46c82e1b195..5707dfc743b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,10 +1,15 @@
-# **what?** - This workflow builds python packages and ensures they can be
+# **what?**
+# This workflow builds python packages and ensures they can be
 # installed on supported OS and python versions. This workflow should not require
 # any secrets since it will run for all pushes, PRs, and
 # forked PRs. Secrets are not passed to workflows from forked PRs.
-# **why?** - Ensure that dbt and its dependencies are able to be packaged
+
+# **why?**
+# Ensure that dbt and its dependencies are able to be packaged
 # and installed.
-# **when?** - This will run when pushing to protected branches, pull requests,
+
+# **when?**
+# This will run when pushing to protected branches, pull requests,
 # and manual dispatch.
 
 name: Build
@@ -16,13 +21,24 @@ on:
       - "develop"
       - "*.latest"
       - "releases/*"
-  workflow_dispatch:
   pull_request:
+    branches-ignore:
+      - "main"
+      - "develop"
+      - "*.latest"
+      - "releases/*"
+  workflow_dispatch:
+
+permissions: read-all
 
 concurrency:
   group: build-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   build:
     name: Build packages
@@ -40,16 +56,24 @@ jobs:
 
       - name: Upgrade python dependencies
         run: |
-          pip install --upgrade pip setuptools wheel
+          python -m pip install --upgrade pip
           pip --version
+          pip install --upgrade setuptools wheel twine check-wheel-contents
 
       - name: Build distributions
         run: ./scripts/build-dist.sh
 
       - name: Show distributions
-        shell: bash
         run: ls -lh dist/
 
+      - name: Check distribution descriptions
+        run: |
+          twine check dist/*
+
+      - name: Check wheel contents
+        run: |
+          check-wheel-contents dist/*.whl --ignore W007,W008
+
       - uses: actions/upload-artifact@v2
         with:
           name: dist
@@ -71,32 +95,19 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
+      - name: Upgrade python dependencies
+        run: |
+          python -m pip install --upgrade pip
+
       - uses: actions/download-artifact@v2
         with:
           name: dist
           path: dist/
 
       - name: Show distributions
-        shell: bash
         run: ls -lh dist/
 
-      - name: Upgrade python dependencies
-        run: |
-          pip install --upgrade pip twine check-wheel-contents
-          pip --version
-          twine --version
-          check-wheel-contents --version
-
-      - name: Check distribution descriptions
-        run: |
-          twine check dist/*
-
-      - name: Check wheel contents
-        run: |
-          check-wheel-contents dist/*.whl --ignore W007,W008
-
       - name: Install wheel distributions
-        shell: bash
         run: |
           find ./dist/*.whl -maxdepth 1 -type f | xargs pip install --force-reinstall --find-links=dist/
 
@@ -105,7 +116,6 @@ jobs:
           dbt --version
 
       - name: Install source distributions
-        shell: bash
         run: |
           find ./dist/*.gz -maxdepth 1 -type f | xargs pip install --force-reinstall --find-links=dist/
 
diff --git a/.github/workflows/integration-pr.yml b/.github/workflows/integration-pr.yml
deleted file mode 100644
index e965000239e..00000000000
--- a/.github/workflows/integration-pr.yml
+++ /dev/null
@@ -1,193 +0,0 @@
-# **This is not a trusted workflow.**
-# **what?** - This workflow runs integration tests for supported OS,
-# python versions and core adapters. It will only run tests for
-# related file changes. Use the `test all` and `test ${adapter}`
-# label to manually run all or additional tests. Use `ok to test`
-# label to mark PRs from forked repositories that are safe to run integration
-# tests for. Requires secrets to run against different warehouses.
-# **why?** - This checks the functionality of dbt from a user's perspective
-# and attempts to catch functional regressions.
-# **when?** - This workflow will run for all pull requests (including those
-# forks).
-
-name: PR Integration Tests
-
-on:
-  pull_request_target:
-
-permissions: read-all
-
-concurrency:
-  group: integration-pr-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  pre-checks:
-    runs-on: ubuntu-latest
-    outputs:
-      has-postgres-changes: ${{ steps.check-changes.outputs.postgres == 'true' }}
-      has-snowflake-changes: ${{ steps.check-changes.outputs.snowflake == 'true' }}
-      has-bigquery-changes: ${{ steps.check-changes.outputs.bigquery == 'true' }}
-      has-redshift-changes: ${{ steps.check-changes.outputs.redshift == 'true' }}
-    steps:
-      - name: Check out the repository
-        uses: actions/checkout@v2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - name: Check if relevant files changed
-        uses: dorny/paths-filter@v2 # https://github.com/marketplace/actions/paths-changes-filter
-        id: check-changes
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          filters: |
-            postgres:
-              - 'core/**'
-              - 'plugins/postgres/**'
-            snowflake:
-              - 'core/**'
-              - 'plugins/snowflake/**'
-            bigquery:
-              - 'core/**'
-              - 'plugins/bigquery/**'
-            redshift:
-              - 'core/**'
-              - 'plugins/redshift/**'
-              - 'plugins/postgres/**'
-
-  test:
-    name: ${{ matrix.adapter }} ${{ matrix.python-version }} / ${{ matrix.os }}
-    if: >-
-      github.event.pull_request.head.repo.full_name == github.repository ||
-      contains(github.event.pull_request.labels.*.name, 'ok to test')
-    needs: pre-checks
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        adapter: [postgres, snowflake, redshift, bigquery]
-        python-version: [3.8]
-    env:
-      TOXENV: integration-${{ matrix.adapter }}
-      PYTEST_ADDOPTS: "-v --color=yes -nauto"
-    steps:
-      - name: Check out the repository
-        uses: actions/checkout@v2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          persist-credentials: false
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Set up postgres (linux)
-        if: |
-          matrix.adapter == 'postgres' &&
-          runner.os == 'Linux'
-        uses: ./.github/actions/setup-postgres-linux
-
-      - name: Set up postgres (macos)
-        if: |
-          matrix.adapter == 'postgres' &&
-          runner.os == 'macOS'
-        uses: ./.github/actions/setup-postgres-macos
-
-      - name: Set up postgres (windows)
-        if: |
-          matrix.adapter == 'postgres' &&
-          runner.os == 'Windows'
-        uses: ./.github/actions/setup-postgres-windows
-
-      - name: Upgrade pip
-        run: |
-          pip install --upgrade pip
-          pip --version
-
-      - name: Install tox
-        run: |
-          pip install tox
-          tox --version
-
-      - name: Run tox (postgres)
-        if: >-
-          matrix.adapter == 'postgres' &&
-          (
-            needs.pre-checks.outputs.has-postgres-changes ||
-            contains(github.event.pull_request.labels.*.name, 'test all') ||
-            contains(github.event.pull_request.labels.*.name, 'test postgres')
-          )
-        run: tox
-
-      - name: Run tox (redshift)
-        if: >-
-          matrix.adapter == 'redshift' &&
-          (
-            needs.pre-checks.outputs.has-redshift-changes ||
-            contains(github.event.pull_request.labels.*.name, 'test all') ||
-            contains(github.event.pull_request.labels.*.name, 'test redshift')
-          )
-        env:
-          REDSHIFT_TEST_DBNAME: ${{ secrets.REDSHIFT_TEST_DBNAME }}
-          REDSHIFT_TEST_PASS: ${{ secrets.REDSHIFT_TEST_PASS }}
-          REDSHIFT_TEST_USER: ${{ secrets.REDSHIFT_TEST_USER }}
-          REDSHIFT_TEST_PORT: ${{ secrets.REDSHIFT_TEST_PORT }}
-          REDSHIFT_TEST_HOST: ${{ secrets.REDSHIFT_TEST_HOST }}
-        run: tox
-
-      - name: Run tox (snowflake)
-        if: >-
-          matrix.adapter == 'snowflake' &&
-          (
-            needs.pre-checks.outputs.has-snowflake-changes ||
-            contains(github.event.pull_request.labels.*.name, 'test all') ||
-            contains(github.event.pull_request.labels.*.name, 'test snowflake')
-          )
-        env:
-          SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.SNOWFLAKE_TEST_ACCOUNT }}
-          SNOWFLAKE_TEST_PASSWORD: ${{ secrets.SNOWFLAKE_TEST_PASSWORD }}
-          SNOWFLAKE_TEST_USER: ${{ secrets.SNOWFLAKE_TEST_USER }}
-          SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.SNOWFLAKE_TEST_WAREHOUSE }}
-          SNOWFLAKE_TEST_OAUTH_REFRESH_TOKEN: ${{ secrets.SNOWFLAKE_TEST_OAUTH_REFRESH_TOKEN }}
-          SNOWFLAKE_TEST_OAUTH_CLIENT_ID: ${{ secrets.SNOWFLAKE_TEST_OAUTH_CLIENT_ID }}
-          SNOWFLAKE_TEST_OAUTH_CLIENT_SECRET: ${{ secrets.SNOWFLAKE_TEST_OAUTH_CLIENT_SECRET }}
-          SNOWFLAKE_TEST_ALT_DATABASE: ${{ secrets.SNOWFLAKE_TEST_ALT_DATABASE }}
-          SNOWFLAKE_TEST_ALT_WAREHOUSE: ${{ secrets.SNOWFLAKE_TEST_ALT_WAREHOUSE }}
-          SNOWFLAKE_TEST_DATABASE: ${{ secrets.SNOWFLAKE_TEST_DATABASE }}
-          SNOWFLAKE_TEST_QUOTED_DATABASE: ${{ secrets.SNOWFLAKE_TEST_QUOTED_DATABASE }}
-          SNOWFLAKE_TEST_ROLE: ${{ secrets.SNOWFLAKE_TEST_ROLE }}
-        run: tox
-
-      - name: Run tox (bigquery)
-        if: >-
-          matrix.adapter == 'bigquery' &&
-          (
-            needs.pre-checks.outputs.has-bigquery-changes ||
-            contains(github.event.pull_request.labels.*.name, 'test all') ||
-            contains(github.event.pull_request.labels.*.name, 'test bigquery')
-          )
-        env:
-          BIGQUERY_SERVICE_ACCOUNT_JSON: ${{ secrets.BIGQUERY_SERVICE_ACCOUNT_JSON }}
-          BIGQUERY_TEST_ALT_DATABASE: ${{ secrets.BIGQUERY_TEST_ALT_DATABASE }}
-        run: tox
-
-  post-checks:
-    runs-on: ubuntu-latest
-    needs: test
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Needs permission PR comment
-        if: >-
-          needs.test.result == 'skipped' &&
-          github.event.pull_request.head.repo.full_name != github.repository
-        uses: unsplash/comment-on-pr@master
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          msg: |
-            "You do not have permissions to run integration tests, @dbt-labs/core "\
-            "needs to label this PR with `ok to test` in order to run integration tests!"
-          check_for_duplicate_msg: true
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 3e698362865..b1c4da19d7f 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -1,10 +1,22 @@
-# **what?** - This workflow runs all integration tests for supported OS
-# and python versions and core adapters. Requires secrets to run against
-# different warehouses. This is a trusted workflow.
-# **why?** - This checks the functionality of dbt from a user's perspective
+# **what?**
+# This workflow runs all integration tests for supported OS
+# and python versions and core adapters. If triggered by PR,
+# the workflow will only run tests for adapters related
+# to code changes. Use the `test all` and `test ${adapter}`
+# label to run all or additional tests. Use `ok to test`
+# label to mark PRs from forked repositories that are safe
+# to run integration tests for. Requires secrets to run
+# against different warehouses.
+
+# **why?**
+# This checks the functionality of dbt from a user's perspective
 # and attempts to catch functional regressions.
-# **when?** - This workflow will run on every push to a protected branch
-# and when manually triggered.
+
+# **when?**
+# This workflow will run on every push to a protected branch
+# and when manually triggered. It will also run for all PRs, including
+# PRs from forks. The workflow will be skipped until there is a label
+# to mark the PR as safe to run.
 
 name: Integration Tests
 
@@ -15,22 +27,77 @@ on:
       - "develop"
       - "*.latest"
       - "releases/*"
+  pull_request_target:
+    branches-ignore:
+      - "main"
+      - "develop"
+      - "*.latest"
+      - "releases/*"
   workflow_dispatch:
 
+permissions: read-all
+
 concurrency:
   group: integration-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
+  pre-checks:
+    runs-on: ubuntu-latest
+    outputs:
+      has-postgres-changes: ${{ steps.check-changes.outputs.postgres == 'true' }}
+      has-snowflake-changes: ${{ steps.check-changes.outputs.snowflake == 'true' }}
+      has-bigquery-changes: ${{ steps.check-changes.outputs.bigquery == 'true' }}
+      has-redshift-changes: ${{ steps.check-changes.outputs.redshift == 'true' }}
+    steps:
+      - name: Check out the repository (non-PR)
+        if: github.event_name != 'pull_request_target'
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+
+      - name: Check out the repository (PR)
+        if: github.event_name == 'pull_request_target'
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Check if relevant files changed
+        # https://github.com/marketplace/actions/paths-changes-filter
+        uses: dorny/paths-filter@v2
+        id: check-changes
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          filters: |
+            postgres:
+              - 'core/**'
+              - 'plugins/postgres/**'
+            snowflake:
+              - 'core/**'
+              - 'plugins/snowflake/**'
+            bigquery:
+              - 'core/**'
+              - 'plugins/bigquery/**'
+            redshift:
+              - 'core/**'
+              - 'plugins/redshift/**'
+              - 'plugins/postgres/**'
+
   test:
     name: ${{ matrix.adapter }} ${{ matrix.python-version }} / ${{ matrix.os }}
+    # run if not a pull request or has a label to mark as safe to test
+    if: >-
+      github.event_name != 'pull_request_target' ||
+      contains(github.event.pull_request.labels.*.name, 'ok to test')
     runs-on: ${{ matrix.os }}
+    needs: pre-checks
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
         adapter: [postgres, snowflake, redshift, bigquery]
-        python-version: [3.6, 3.7, 3.8, 3.9]
+        python-version: [3.6, 3.7, 3.8, 3.9] # TODO: only run python 3.8 on PRs
 
     env:
       TOXENV: integration-${{ matrix.adapter }}
@@ -38,10 +105,18 @@ jobs:
 
     steps:
       - name: Check out the repository
+        if: github.event_name != 'pull_request_target'
         uses: actions/checkout@v2
         with:
           persist-credentials: false
 
+      - name: Check out the repository (PR)
+        if: github.event_name == 'pull_request_target'
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha }}
+
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
@@ -67,7 +142,7 @@ jobs:
 
       - name: Upgrade pip
         run: |
-          pip install --upgrade pip
+          python -m pip install --upgrade pip
           pip --version
 
       - name: Install tox
@@ -76,11 +151,29 @@ jobs:
           tox --version
 
       - name: Run tox (postgres)
-        if: matrix.adapter == 'postgres'
+        # run if postgres integration tests
+        # and is not a PR or has relevant changes/specified label
+        if: >-
+          matrix.adapter == 'postgres' &&
+          (
+            github.event_name != 'pull_request_target' ||
+            needs.pre-checks.outputs.has-postgres-changes ||
+            contains(github.event.pull_request.labels.*.name, 'test all') ||
+            contains(github.event.pull_request.labels.*.name, 'test postgres')
+          )
         run: tox
 
       - name: Run tox (redshift)
-        if: matrix.adapter == 'redshift'
+        # run if redshift integration tests
+        # and is not a PR or has relevant changes/specified label
+        if: >-
+          matrix.adapter == 'redshift' &&
+          (
+            github.event_name != 'pull_request_target' ||
+            needs.pre-checks.outputs.has-redshift-changes ||
+            contains(github.event.pull_request.labels.*.name, 'test all') ||
+            contains(github.event.pull_request.labels.*.name, 'test redshift')
+          )
         env:
           REDSHIFT_TEST_DBNAME: ${{ secrets.REDSHIFT_TEST_DBNAME }}
           REDSHIFT_TEST_PASS: ${{ secrets.REDSHIFT_TEST_PASS }}
@@ -90,7 +183,16 @@ jobs:
         run: tox
 
       - name: Run tox (snowflake)
-        if: matrix.adapter == 'snowflake'
+        # run if snowflake integration tests
+        # and is not a PR or has relevant changes/specified label
+        if: >-
+          matrix.adapter == 'snowflake' &&
+          (
+            github.event_name != 'pull_request_target' ||
+            needs.pre-checks.outputs.has-snowflake-changes ||
+            contains(github.event.pull_request.labels.*.name, 'test all') ||
+            contains(github.event.pull_request.labels.*.name, 'test snowflake')
+          )
         env:
           SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.SNOWFLAKE_TEST_ACCOUNT }}
           SNOWFLAKE_TEST_PASSWORD: ${{ secrets.SNOWFLAKE_TEST_PASSWORD }}
@@ -107,8 +209,37 @@ jobs:
         run: tox
 
       - name: Run tox (bigquery)
-        if: matrix.adapter == 'bigquery'
+        # run if bigquery integration tests
+        # and is not a PR or has relevant changes/specified label
+        if: >-
+          matrix.adapter == 'bigquery' &&
+          (
+            github.event_name != 'pull_request_target' ||
+            needs.pre-checks.outputs.has-bigquery-changes ||
+            contains(github.event.pull_request.labels.*.name, 'test all') ||
+            contains(github.event.pull_request.labels.*.name, 'test bigquery')
+          )
         env:
           BIGQUERY_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.BIGQUERY_TEST_SERVICE_ACCOUNT_JSON }}
           BIGQUERY_TEST_ALT_DATABASE: ${{ secrets.BIGQUERY_TEST_ALT_DATABASE }}
         run: tox
+
+  post-checks:
+    runs-on: ubuntu-latest
+    needs: test
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Needs permission PR comment
+        if: >-
+          github.event_name == 'pull_request_target' &&
+          needs.test.result == 'skipped' &&
+          github.event.pull_request.head.repo.full_name != github.repository
+        uses: unsplash/comment-on-pr@master
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          msg: |
+            "You do not have permissions to run integration tests, @dbt-labs/core "\
+            "needs to label this PR with `ok to test` in order to run integration tests!"
+          check_for_duplicate_msg: true
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 00000000000..16766a8219c
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,70 @@
+# **what?**
+# This workflow contains static code checks. This workflow
+# should require no secrets since it will be triggered for all pushes, PRs, and
+# forked PRs. Secrets are not passed to workflows from forked PRs.
+
+# **why?**
+# To ensure all code being merged into the project passes a
+# minimum threshold of quality.
+
+# **when?**
+# This workflow will run on every push to a protected
+# branch, for all pull requests, and when manually triggered.
+
+name: Lint
+
+on:
+  push:
+    branches:
+      - "main"
+      - "develop"
+      - "*.latest"
+      - "releases/*"
+  pull_request:
+    branches-ignore:
+      - "main"
+      - "develop"
+      - "*.latest"
+      - "releases/*"
+  workflow_dispatch:
+
+permissions: read-all
+
+concurrency:
+  group: lint-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: ${{ matrix.toxenv }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        toxenv: [flake8, mypy]
+
+    env:
+      TOXENV: ${{ matrix.toxenv }}
+      PYTEST_ADDOPTS: "-v --color=yes"
+
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+
+      - name: Upgrade python dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip --version
+
+      - name: Install tox
+        run: |
+          pip install tox
+          tox --version
+
+      - name: Run tox
+        run: tox
diff --git a/.github/workflows/main.yml b/.github/workflows/unit.yml
similarity index 53%
rename from .github/workflows/main.yml
rename to .github/workflows/unit.yml
index 76438c696d6..c1a3d55964d 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/unit.yml
@@ -1,13 +1,18 @@
-# **what?** - This workflow contains unit tests for supported OS and
-# python versions as well as static code checks. This workflow
-# should require no secrets since it will be triggered for all pushes, PRs, and
-# forked PRs. Secrets are not passed to workflows from forked PRs.
-# **why?** - To ensure all code being merged into the project passes a
+# **what?**
+# This workflow contains unit tests for supported OS and
+# python versions. This workflow should require no secrets since
+# it will be triggered for all pushes, PRs, and forked PRs.
+# Secrets are not passed to workflows from forked PRs.
+
+# **why?**
+# To ensure all code being merged into the project passes a
 # minimum threshold of quality.
-# **when?** - This workflow will run on every push to a protected
+
+# **when?**
+# This workflow will run on every push to a protected
 # branch, for all pull requests, and when manually triggered.
 
-name: Main CI
+name: Unit Tests
 
 on:
   push:
@@ -17,32 +22,30 @@ on:
       - "*.latest"
       - "releases/*"
   pull_request:
+    branches-ignore:
+      - "main"
+      - "develop"
+      - "*.latest"
+      - "releases/*"
   workflow_dispatch:
 
+permissions: read-all
+
 concurrency:
-  group: ci-${{ github.event_name }}-${{ github.ref }}
+  group: unit-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   test:
-    name: ${{ matrix.toxenv }} ${{ matrix.python-version }} / ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
+    name: ${{ matrix.toxenv }} ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest]
-        toxenv: [unit]
         python-version: [3.6, 3.7, 3.8] # TODO: support unit testing for python 3.9 (https://github.com/dbt-labs/dbt/issues/3689)
-        include:
-          - os: ubuntu-latest
-            toxenv: flake8
-            python-version: 3.8
-          - os: ubuntu-latest
-            toxenv: mypy
-            python-version: 3.8
 
     env:
-      TOXENV: ${{ matrix.toxenv }}
+      TOXENV: "unit"
       PYTEST_ADDOPTS: "-v --color=yes"
 
     steps:
@@ -58,7 +61,7 @@ jobs:
 
       - name: Upgrade python dependencies
         run: |
-          pip install --upgrade pip
+          python -m pip install --upgrade pip
           pip --version
 
       - name: Install tox


Code review comments:
diff_hunk: @@ -17,32 +22,30 @@ on:
       - "*.latest"
       - "releases/*"
   pull_request:
+    branches-ignore:
path: .github/workflows/unit.yml
text: @user1:
Do we have unit tests running in another workflow for PRs to `develop`? 

@author:
oh wow, I misunderstood what branches-ignore what doing. This is the only workflow running unit tests! removing this branches-ignore code from all workflows