Enable App CI for staging PRs

.github/workflows/bunTests.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths:
       - 'server/**'
       - 'src/**'
@@ -30,6 +30,7 @@ concurrency:
 jobs:
   test:
     name: Bun tests
+    if: ${{ github.event_name != 'pull_request' || github.actor != 'os-botify[bot]' }}
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - name: Checkout

.github/workflows/checkContributorPlusChecklistHeading.yml

@@ -3,7 +3,7 @@ name: Check Contributor+ checklist heading
 on:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths:
       - 'contributingGuides/CONTRIBUTOR_PLUS_CHECKLIST.md'
       - 'scripts/checkContributorPlusChecklistHeading.sh'
@@ -19,6 +19,7 @@ concurrency:
 jobs:
   check:
     name: Check Contributor+ checklist heading
+    if: github.actor != 'os-botify[bot]'
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout

.github/workflows/checkSVGCompression.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths: ['**.svg']
 
 permissions:
@@ -17,7 +17,7 @@ concurrency:
 jobs:
   compress-svg:
     name: Compress SVG check
-    if: ${{ github.actor != 'OSBotify' || github.event_name == 'workflow_call' }}
+    if: ${{ (github.actor != 'OSBotify' || github.event_name == 'workflow_call') && (github.event_name != 'pull_request' || github.actor != 'os-botify[bot]') }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout

.github/workflows/checkValidateCodeTerminology.yml

@@ -3,11 +3,12 @@ name: Check validateCode terminology
 on:
   pull_request:
     types: [opened, synchronize]
-    branches: [main]
+    branches: [main, staging]
     paths: ['**.ts', '**.tsx', '**.md']
 
 jobs:
   check:
+    if: github.actor != 'os-botify[bot]'
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout

.github/workflows/cloudflareWorkerTests.yml

@@ -3,7 +3,7 @@ name: Cloudflare Worker tests
 on:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths:
       - 'web/cloudflare-worker/**'
       # The tests check its inline scripts against the CSP hashes.
@@ -21,7 +21,7 @@ permissions:
 jobs:
   test:
     name: Cloudflare Worker tests
-    if: github.actor != 'OSBotify'
+    if: github.actor != 'OSBotify' && github.actor != 'os-botify[bot]'
     runs-on: blacksmith-2vcpu-ubuntu-2404
     defaults:
       run:

.github/workflows/cspell.yml

@@ -3,10 +3,11 @@ name: Spell check
 on:
   pull_request:
     types: [opened, synchronize]
-    branches: [main]
+    branches: [main, staging]
 
 jobs:
   spellcheck:
+    if: github.actor != 'os-botify[bot]'
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - uses: useblacksmith/checkout@0647fdbab2614a5eb86d2971070e325060d91056 # v1.7.0

.github/workflows/knip.yml

@@ -3,7 +3,7 @@ name: Knip check
 on:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths:
       - '**.js'
       - '**.jsx'
@@ -24,7 +24,11 @@ concurrency:
 jobs:
   knip-compare:
     name: Compare knip issues against main
+    if: github.actor != 'os-botify[bot]'
     runs-on: blacksmith-2vcpu-ubuntu-2404
+    env:
+      # The PR's target branch, so a PR into staging is not compared with main.
+      BASE_REF: ${{ github.base_ref || 'main' }}
     steps:
       - name: Checkout PR
         uses: useblacksmith/checkout@0647fdbab2614a5eb86d2971070e325060d91056 # v1.7.0
@@ -35,12 +39,12 @@ jobs:
       - name: Run knip on PR
         run: KNIP=true npx knip --reporter json --no-exit-code > /tmp/knip-pr.json
 
-      - name: Checkout main
+      - name: Checkout base branch
         run: |
-          git fetch origin main --no-tags --depth=1
-          git checkout origin/main
+          git fetch origin "$BASE_REF" --no-tags --depth=1
+          git checkout "origin/$BASE_REF"
 
-      - name: Run knip on main
+      - name: Run knip on base branch
         run: KNIP=true npx knip --reporter json --no-exit-code > /tmp/knip-main.json
 
       - name: Restore PR workspace

.github/workflows/lint.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths:
       [
         '**.js',
@@ -30,7 +30,7 @@ concurrency:
 jobs:
   lint:
     name: ESLint check
-    if: ${{ github.event.head_commit.author.name != 'OSBotify' || github.event_name == 'push' }}
+    if: ${{ (github.event.head_commit.author.name != 'OSBotify' || github.event_name == 'push') && (github.event_name != 'pull_request' || github.actor != 'os-botify[bot]') }}
     # A cold-cache run loads the full TypeScript program into every worker (~12GB each), plus any extra
     # tsconfig project a file is mapped to. 2 workers need more than the 32GB an 8vcpu runner has.
     runs-on: blacksmith-16vcpu-ubuntu-2404

.github/workflows/nativeDependencies.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths:
       - '.github/workflows/nativeDependencies.yml'
       - 'ios/Podfile'
@@ -37,6 +37,7 @@ concurrency:
 jobs:
   nativeDependencies:
     name: Check for unused native dependencies
+    if: github.actor != 'os-botify[bot]'
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout

.github/workflows/oxfmt.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths: ['**.js', '**.ts', '**.tsx', '**.json', '**.mjs', '**.cjs', '**.yml', '**.yaml', '.oxfmtrc.json', 'config/.editorconfig', '.watchmanconfig', '.imgbotconfig']
 
 concurrency:
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   oxfmt:
     name: Oxfmt check
-    if: ${{ github.actor != 'OSBotify' || github.event_name == 'workflow_call' }}
+    if: ${{ (github.actor != 'OSBotify' || github.event_name == 'workflow_call') && (github.event_name != 'pull_request' || github.actor != 'os-botify[bot]') }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout

.github/workflows/oxlint.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths: ['**.js', '**.ts', '**.tsx', '**.json', '**.mjs', '**.cjs', 'oxlint.config.mts', 'config/oxlint/**', 'scripts/lint/**', '.github/workflows/oxlint.yml']
 
 concurrency:
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   oxlint:
     name: Oxlint check (non-blocking)
-    if: ${{ github.event.head_commit.author.name != 'OSBotify' || github.event_name == 'push' }}
+    if: ${{ (github.event.head_commit.author.name != 'OSBotify' || github.event_name == 'push') && (github.event_name != 'pull_request' || github.actor != 'os-botify[bot]') }}
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - name: Checkout

.github/workflows/react-compiler-compliance.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths: ['**.ts', '**.tsx']
 
 concurrency:
@@ -13,7 +13,7 @@ concurrency:
 jobs:
   react-compiler-compliance:
     name: React Compiler Compliance
-    if: ${{ github.actor != 'OSBotify' }}
+    if: ${{ github.actor != 'OSBotify' && (github.event_name != 'pull_request' || github.actor != 'os-botify[bot]') }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:

.github/workflows/reassurePerformanceTests.yml

@@ -3,7 +3,7 @@ name: Reassure Performance Tests
 on:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     # Ordered: the last matching pattern wins.
     paths:
       - '**'
@@ -64,7 +64,7 @@ concurrency:
 
 jobs:
   baseline-perf-tests:
-    if: ${{ github.actor != 'OSBotify' }}
+    if: ${{ github.actor != 'OSBotify' && github.actor != 'os-botify[bot]' }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout
@@ -91,7 +91,7 @@ jobs:
 
       # Before setupNode: the key hashes no lockfile, and not running setupNode is most of the saving.
       # Restore-only for the same reasons as the Jest transform cache below.
-      - name: Restore the baseline measured on main
+      - name: Restore the cached baseline
         id: restoreBaseline
         # v5.0.1
         uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb
@@ -107,9 +107,9 @@ jobs:
           CACHE_HIT: ${{ steps.restoreBaseline.outputs.cache-hit }}
         run: |
           if [[ "$CACHE_HIT" == "true" ]]; then
-            echo "::notice::Restored main's baseline for $BASELINE_SHA from the cache; not measuring it here."
+            echo "::notice::Restored the baseline for $BASELINE_SHA from the cache; not measuring it here."
           else
-            echo "::warning::No cached baseline for $BASELINE_SHA - measuring it in this job. Expected when the seed run on that commit has not finished or failed; otherwise seedJestPerfCache.yml has stopped writing the entry."
+            echo "::warning::No cached baseline for $BASELINE_SHA - measuring it in this job. Expected when the PR targets a branch other than main (seedJestPerfCache.yml only seeds main), or when the seed run on that commit has not finished or failed; otherwise seedJestPerfCache.yml has stopped writing the entry."
           fi
 
       - name: Check out the baseline commit
@@ -119,7 +119,7 @@ jobs:
           BASELINE_SHA: ${{ steps.baselineCommit.outputs.sha }}
         run: |
           set -e
-          # That commit, not the tip of main: the tip moves mid-run, and measuring the two sides at
+          # That commit, not the tip of the base branch: the tip moves mid-run, and measuring the two sides at
           # different trees is the noise this comparison exists to detect. Only its source tree is
           # needed, and a reachable SHA can be fetched bare.
           git fetch origin "$BASELINE_SHA" --no-tags --depth=1
@@ -175,7 +175,7 @@ jobs:
           include-hidden-files: true
 
   branch-perf-tests:
-    if: ${{ github.actor != 'OSBotify' }}
+    if: ${{ github.actor != 'OSBotify' && github.actor != 'os-botify[bot]' }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout
@@ -231,7 +231,7 @@ jobs:
           include-hidden-files: true
 
   validate-perf-tests:
-    if: ${{ github.actor != 'OSBotify' }}
+    if: ${{ github.actor != 'OSBotify' && github.actor != 'os-botify[bot]' }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [baseline-perf-tests, branch-perf-tests]
     steps:

.github/workflows/shellCheck.yml

@@ -4,12 +4,12 @@ on:
   workflow_call:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths: ['**.sh']
 
 jobs:
   lint:
-    if: ${{ github.actor != 'OSBotify' || github.event_name == 'workflow_call' }}
+    if: ${{ (github.actor != 'OSBotify' || github.event_name == 'workflow_call') && (github.event_name != 'pull_request' || github.actor != 'os-botify[bot]') }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout

.github/workflows/test.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths: ['**.js', '**.ts', '**.tsx', 'package.json', 'package-lock.json']
 
 concurrency:
@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   jest:
-    if: ${{ github.event.head_commit.author.name != 'OSBotify' && github.event.head_commit.author.name != 'imgbot[bot]' || github.event_name == 'workflow_call' }}
+    if: ${{ (github.event.head_commit.author.name != 'OSBotify' && github.event.head_commit.author.name != 'imgbot[bot]' || github.event_name == 'workflow_call') && (github.event_name != 'pull_request' || github.actor != 'os-botify[bot]') }}
     runs-on: blacksmith-8vcpu-ubuntu-2404
     env:
       CI: true
@@ -83,7 +83,7 @@ jobs:
           fail_ci_if_error: false
 
   storybookTests:
-    if: ${{ github.event.head_commit.author.name != 'OSBotify' && github.event.head_commit.author.name != 'imgbot[bot]' || github.event_name == 'workflow_call' }}
+    if: ${{ (github.event.head_commit.author.name != 'OSBotify' && github.event.head_commit.author.name != 'imgbot[bot]' || github.event_name == 'workflow_call') && (github.event_name != 'pull_request' || github.actor != 'os-botify[bot]') }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     name: Storybook tests
     steps:

.github/workflows/testSyncVersions.yml

@@ -6,7 +6,7 @@ name: Test syncVersions script
 on:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths: ['.github/scripts/syncVersions.sh', 'tests/tooling/SyncVersions.test.ts', '.github/workflows/testSyncVersions.yml']
 
 concurrency:
@@ -15,6 +15,7 @@ concurrency:
 
 jobs:
   testSyncVersions:
+    if: github.actor != 'os-botify[bot]'
     runs-on: blacksmith-6vcpu-macos-latest
     steps:
       - name: Check out

.github/workflows/typecheck.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
   pull_request:
     types: [opened, synchronize]
-    branches-ignore: [staging, production]
+    branches-ignore: [production]
     paths: ['**.js', '**.ts', '**.tsx', 'package.json', 'package-lock.json', '**/tsconfig*.json']
 
 concurrency:
@@ -13,8 +13,12 @@ concurrency:
 
 jobs:
   typecheck:
-    if: ${{ github.actor != 'OSBotify' || github.event_name == 'workflow_call' }}
+    if: ${{ (github.actor != 'OSBotify' || github.event_name == 'workflow_call') && (github.event_name != 'pull_request' || github.actor != 'os-botify[bot]') }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      # The PR's target branch, so a PR into staging is not compared with main.
+      # Reusable calls have no base ref, so they retain the existing main behavior.
+      BASE_REF: ${{ github.base_ref || 'main' }}
     steps:
       - uses: useblacksmith/checkout@0647fdbab2614a5eb86d2971070e325060d91056 # v1.7.0
 
@@ -27,14 +31,14 @@ jobs:
 
       - name: Check for new JavaScript files
         run: |
-          git fetch origin main --no-tags --depth=1
+          git fetch origin "$BASE_REF" --no-tags --depth=1
 
           # Explanation:
           #  - comm is used to get the intersection between two bash arrays
           #    - git diff is used to see the files that were added on this branch
-          #    - gh pr view is used to list files touched by this PR. Git diff may give false positives if the branch isn't up-to-date with main
+          #    - gh pr view is used to list files touched by this PR. Git diff may give false positives if the branch isn't up-to-date with the base branch
           #  - wc counts the words in the result of the intersection
-          count_new_js=$(comm -1 -2 <(git diff --name-only --diff-filter=A origin/main HEAD -- 'src/*.js' '__mocks__/*.js' '.storybook/*.js' 'assets/*.js' 'config/*.js' 'jest/*.js' 'scripts/*.js' 'tests/*.js' '.github/libs/*.js' '.github/scripts/*.js' ':!src/libs/SearchParser/*.js' ':!config/babel/*.js') <(gh pr view ${{ github.event.pull_request.number }} --json files | jq -r '.files | map(.path) | .[]') | wc -l)
+          count_new_js=$(comm -1 -2 <(git diff --name-only --diff-filter=A "origin/$BASE_REF" HEAD -- 'src/*.js' '__mocks__/*.js' '.storybook/*.js' 'assets/*.js' 'config/*.js' 'jest/*.js' 'scripts/*.js' 'tests/*.js' '.github/libs/*.js' '.github/scripts/*.js' ':!src/libs/SearchParser/*.js' ':!config/babel/*.js') <(gh pr view ${{ github.event.pull_request.number }} --json files | jq -r '.files | map(.path) | .[]') | wc -l)
           if [ "$count_new_js" -gt "0" ]; then
             echo "ERROR: Found new JavaScript files in the project; use TypeScript instead."
             exit 1