Run CI checks on pull requests from forks

.github/workflows/pr-url.yml

@@ -4,7 +4,8 @@ on:
     types: [opened]
 jobs:
   pr-url:
-    if: github.repository_owner == 'microbit-foundation'
+    # Fork branches aren't deployed to the review site.
+    if: github.repository_owner == 'microbit-foundation' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: microbit-foundation/action-pr-url-template@v0.1.2

.github/workflows/pr.yml

@@ -0,0 +1,58 @@
+name: pr
+
+# Checks for pull requests from forks, which build.yml doesn't see as it runs
+# on push. No secrets, theme or deploy: this runs contributor code. The repo
+# requires maintainer approval before it runs for external contributors.
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  # renovate: datasource=npm depName=npm
+  NPM_VERSION: "11"
+
+jobs:
+  build:
+    # Branches in this repo are already checked by build.yml.
+    if: github.event.pull_request.head.repo.full_name != github.repository
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    env:
+      VITE_STAGE: REVIEW
+      VITE_FOUNDATION_BUILD: false
+      FEATURE_PWA: false
+      BASE_URL: /
+      E2E_BASE_URL: /
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Configure node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+        with:
+          node-version: 24.x
+          cache: "npm"
+          registry-url: "https://npm.pkg.github.com"
+      - run: npm install -g npm@${{ env.NPM_VERSION }} --registry=https://registry.npmjs.org
+      - run: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: npm run ci
+      - name: Run Playwright tests
+        timeout-minutes: 10
+        uses: docker://mcr.microsoft.com/playwright:v1.64.1-noble
+        with:
+          args: npx playwright test
+      - name: Store reports
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 3