ci: add monorepo gate required status check (#390)

* chore: update CI workflow to enhance path detection and component checks

* chore: merge ci/cd to gate.yml

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding 'CodeQL / Workflow does not contain permissions'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* chore: update paths-filter action to version 4.0.2 for improved functionality

* chore: simplify output handling in gate workflow and remove frontend checks

* chore: refine condition checks for backend and deploy outputs in gate workflow

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: 3 people

.github/workflows/cd.yml

@@ -0,0 +1,107 @@
+on:
+  push:
+    branches: ["main", "dev"]
+    tags: ["v*.*.*"]
+  pull_request:
+    branches: ["main"]
+  workflow_dispatch:
+
+jobs:
+  changes:
+    name: detect changes
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    outputs:
+      backend: ${{ steps.filter.outputs.backend == 'true' }}
+      deploy: ${{ steps.filter.outputs.deploy == 'true' || steps.filter.outputs.backend == 'true' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed paths
+        id: filter
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 #v4.0.2
+        with:
+          filters: |
+            backend:
+              - 'src/AppHost/**'
+              - 'src/Core/**'
+              - 'src/Infrastructure/**'
+              - 'src/Infrastructure.PostgreSql/**'
+              - 'src/Infrastructure.SqlServer/**'
+              - 'src/Postgres.Migrator/**'
+              - 'src/ServiceDefaults/**'
+              - 'src/WebApi/**'
+              - 'test/**'
+              - 'MoneyGroup.slnx'
+              - 'Directory.*.props'
+              - 'Directory.*.targets'
+              - 'global.json'
+              - '.config/dotnet-tools.json'
+              - 'testconfig.json'
+              - '.github/workflows/**'
+            deploy:
+              - '.github/workflows/**'
+              - '.dockerignore'
+
+  backend:
+    uses: ./.github/workflows/dotnet.yml
+    needs: changes
+    if: ${{ needs.changes.outputs.backend }}
+    secrets: inherit
+    permissions:
+      contents: read
+
+  deploy:
+    uses: ./.github/workflows/docker.yml
+    needs: changes
+    if: ${{ needs.changes.outputs.deploy }}
+    with:
+      is-cd: ${{ github.event_name != 'pull_request' }}
+      environment: Development
+    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+  gate:
+    name: gate
+    needs: [changes, backend, deploy]
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Enforce component checks by changed paths
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          changes_result='${{ needs.changes.result }}'
+          if [[ "${changes_result}" != "success" ]]; then
+            echo "Change detection job did not succeed."
+            exit 1
+          fi
+
+          be_needed='${{ needs.changes.outputs.backend }}'
+          deploy_needed='${{ needs.changes.outputs.deploy }}'
+          be_result='${{ needs.backend.result }}'
+          deploy_result='${{ needs.deploy.result }}'
+
+          echo "backend needed: ${be_needed}, result: ${be_result}"
+          echo "deploy needed: ${deploy_needed}, result: ${deploy_result}"
+
+          if [[ "${be_needed}" == "true" && "${be_result}" != "success" ]]; then
+            echo "Backend checks were required but did not succeed."
+            exit 1
+          fi
+
+          if [[ "${deploy_needed}" == "true" && "${deploy_result}" != "success" ]]; then
+            echo "Deploy checks were required but did not succeed."
+            exit 1
+          fi
+
+          echo "Monorepo gate passed."