From 543fdbc3b4883c50d94dd028099be60f35701763 Mon Sep 17 00:00:00 2001
From: Matt Hillsdon <matt.hillsdon@microbit.org>
Date: Wed, 4 Nov 2026 11:41:56 +0000
Subject: [PATCH] Run CI checks on pull requests from forks

build.yml runs on push, so PRs from forks had no checks. pr.yml runs
typecheck, lint, unit tests, the i18n check, the build and Playwright for
fork PRs, without secrets, the theme package or a deploy.

pr-url.yml now skips fork PRs, as their branches aren't deployed to the
review site.

Remove netlify.toml, which is unused.
---
 .github/workflows/pr-url.yml |  3 +-
 .github/workflows/pr.yml     | 58 ++++++++++++++++++++++++++++++++++++
 netlify.toml                 |  9 ------
 3 files changed, 60 insertions(+), 10 deletions(-)
 create mode 100644 .github/workflows/pr.yml
 delete mode 100644 netlify.toml

diff --git a/.github/workflows/pr-url.yml b/.github/workflows/pr-url.yml
index 1d07493f5..e08f51e82 100644
--- a/.github/workflows/pr-url.yml
+++ b/.github/workflows/pr-url.yml
@@ -4,7 +4,8 @@ on:
     types: [opened]
 jobs:
   pr-url:
-    if: github.repository_owner == 'microbit-foundation'
+    # Fork branches aren't deployed to the review site.
+    if: github.repository_owner == 'microbit-foundation' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: microbit-foundation/action-pr-url-template@v0.1.2
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
new file mode 100644
index 000000000..2dd83d3c6
--- /dev/null
+++ b/.github/workflows/pr.yml
@@ -0,0 +1,58 @@
+name: pr
+
+# Checks for pull requests from forks, which build.yml doesn't see as it runs
+# on push. No secrets, theme or deploy: this runs contributor code. The repo
+# requires maintainer approval before it runs for external contributors.
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  # renovate: datasource=npm depName=npm
+  NPM_VERSION: "11"
+
+jobs:
+  build:
+    # Branches in this repo are already checked by build.yml.
+    if: github.event.pull_request.head.repo.full_name != github.repository
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    env:
+      VITE_STAGE: REVIEW
+      VITE_FOUNDATION_BUILD: false
+      FEATURE_PWA: false
+      BASE_URL: /
+      E2E_BASE_URL: /
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Configure node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+        with:
+          node-version: 24.x
+          cache: "npm"
+          registry-url: "https://npm.pkg.github.com"
+      - run: npm install -g npm@${{ env.NPM_VERSION }} --registry=https://registry.npmjs.org
+      - run: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: npm run ci
+      - name: Run Playwright tests
+        timeout-minutes: 10
+        uses: docker://mcr.microsoft.com/playwright:v1.64.1-noble
+        with:
+          args: npx playwright test
+      - name: Store reports
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 3
diff --git a/netlify.toml b/netlify.toml
deleted file mode 100644
index 79bcd1aa9..000000000
--- a/netlify.toml
+++ /dev/null
@@ -1,9 +0,0 @@
-[Settings]
-[build]
-command = "npm run ci"
-[build.environment]
-  CI = "true"
-[[redirects]]
-  from = "/*"
-  to = "/index.html"
-  status = 200