WIP cirrus: trigger after github action finishes

(TODO this is totally untested and mostly vibe coded.)

Whenever we push changes do docker/**, our docker images for Cirrus
CI will be rebuilt.

However, the Cirrus CI jobs will kick off at the same time as the
Docker builds, so they will likely use old images.  This can cause
surprising (albeit transient) failures.

Fix this by having Cirrus wait for GitHub Actions.

This addresses the second part of
https://github.com/fish-shell/fish-shell/pull/11884#discussion_r2423344925

.cirrus.yml

@@ -1,3 +1,5 @@
+skip: $CIRRUS_REPO_OWNER == 'fish-shell' && $CIRRUS_BRANCH == 'master'
+
 env:
     CIRRUS_CLONE_DEPTH: 100
     CI: 1
@@ -6,12 +8,12 @@ linux_task:
     matrix:
         - name: alpine
           container: &step
-              image: ghcr.io/krobelus/fish-ci/alpine:latest
+              image: ghcr.io/fish-shell/fish-ci/alpine:latest
               memory: 4GB
         - name: jammy
           container:
               <<: *step
-              image: ghcr.io/krobelus/fish-ci/jammy:latest
+              image: ghcr.io/fish-shell/fish-ci/jammy:latest
     tests_script:
         # cirrus at times gives us 32 procs and 2 GB of RAM
         # Unrestriced parallelism results in OOM
@@ -28,9 +30,6 @@ linux_arm_task:
         - name: focal-arm64
           arm_container:
               image: ghcr.io/fish-shell/fish-ci/focal-arm64
-        - name: jammy-armv7-32bit
-          arm_container:
-              image: ghcr.io/fish-shell/fish-ci/jammy-armv7-32bit
     tests_script:
         # cirrus at times gives us 32 procs and 2 GB of RAM
         # Unrestriced parallelism results in OOM
@@ -40,8 +39,7 @@ linux_arm_task:
         - FISH_TEST_MAX_CONCURRENCY=6 cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug ..
         - ninja -j 6 fish
         - ninja fish_run_tests
-    # CI task disabled during RIIR transition
+    only_if: $CIRRUS_REPO_OWNER == 'fish-shell'
-    only_if: false && $CIRRUS_REPO_OWNER == 'fish-shell'
 
 freebsd_task:
     matrix:

.github/workflows/build_docker_images.yml

@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - master
-    paths:
-      - 'docker/**'
   workflow_dispatch:
 
 concurrency:
@@ -14,10 +12,26 @@ concurrency:
 env:
   REGISTRY: ghcr.io
   NAMESPACE: fish-ci
+  ONLY_FOR_REPO_OWNER: fish-shell
 
 jobs:
+  check-docker-changes:
+    if: github.repository_owner == env.ONLY_FOR_REPO_OWNER
+    runs-on: ubuntu-latest
+    outputs:
+      docker-changed: ${{ steps.changes.outputs.docker }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dorny/paths-filter@v3
+        id: changes
+        with:
+          filters: |
+            docker:
+              - 'docker/**'
+
   docker-build:
-    if: github.repository_owner == 'fish-shell'
+    needs: check-docker-changes
+    if: github.repository_owner == env.ONLY_FOR_REPO_OWNER && needs.check-docker-changes.outputs.docker-changed == 'true'
     permissions:
       contents: read
       packages: write
@@ -82,3 +96,31 @@ jobs:
           file: docker/${{ matrix.target }}.Dockerfile
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+  trigger-cirrus:
+    needs: [check-docker-changes, docker-build]
+    if: always() && github.repository_owner == env.ONLY_FOR_REPO_OWNER
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Cirrus CI
+        env:
+          CIRRUS_TOKEN: ${{ secrets.CIRRUS_TOKEN }}
+        run: |
+          set -x
+          # N.B. push-triggered workflows are usually from master.
+          branch=${{ github.ref_name }}
+          repository_id=${{ github.repository_id }}
+          curl -X POST \
+            -H "Authorization: Bearer $CIRRUS_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d '{
+              "query": "mutation {
+                createBuild(input: {
+                  repositoryId: \"$repository_id\",
+                  branch: \"$branch\"
+                })
+                { build { id } }
+              }"
+            }' \
+            https://api.cirrus-ci.com/graphql
+