ci: adopt shared Ready checks and merge policy

.github/workflows/check.yml

@@ -0,0 +1,18 @@
+name: Check
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: check-${{ github.event.pull_request.number }}-${{ github.event.pull_request.draft && 'draft' || 'ready' }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Check
+    uses: fulldotdev/.github/.github/workflows/check.yml@288d0a18bdcc83e2376c91f557577f0dfe4d1e56

.github/workflows/ci.yml

@@ -3,8 +3,7 @@ name: CI
 on:
   pull_request:
     branches: [main]
-  push:
-    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -21,8 +20,7 @@ env:
 jobs:
   validate:
     name: Validate
-    # On release pull requests both checks below are skipped, so skip the job; the organization Check still runs.
-    if: ${{ !startsWith(github.head_ref, 'changeset-release/') }}
+    if: ${{ !github.event.pull_request.draft && !startsWith(github.head_ref, 'changeset-release/') }}
     runs-on: ubuntu-latest
 
     steps:
@@ -49,8 +47,3 @@ jobs:
       - name: Check changeset
         if: github.event_name == 'pull_request' && !startsWith(github.head_ref, 'changeset-release/')
         run: pnpm exec changeset status --since=origin/${{ github.event.pull_request.base.ref }}
-
-      # On pull requests the required organization Check runs pnpm check.
-      - name: Check code
-        if: github.event_name == 'push'
-        run: pnpm check

.github/workflows/ready.yml

@@ -0,0 +1,33 @@
+name: Ready
+
+on:
+  pull_request_target:
+    branches: [main]
+    types:
+      [
+        opened,
+        synchronize,
+        reopened,
+        ready_for_review,
+        converted_to_draft,
+        labeled,
+        unlabeled,
+      ]
+  workflow_run:
+    workflows: [Check, Review event]
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+  statuses: write
+  checks: read
+
+jobs:
+  ready:
+    uses: fulldotdev/.github/.github/workflows/ready.yml@579bcf444a2f964e48ecbeb580b01c921c9f1ea4
+    with:
+      netlify-checks: '["netlify/fulldev-sitex/deploy-preview"]'
+      merge-app-client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+    secrets:
+      merge-app-private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

.github/workflows/review-event.yml

@@ -0,0 +1,14 @@
+name: Review event
+
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+permissions: {}
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - run: echo "Review changed; the trusted Ready workflow will inspect GitHub metadata."

.node-version

@@ -0,0 +1 @@
+24

netlify.toml

@@ -78,8 +78,14 @@ from = "/docs/ui/*"
 to = "/docs/components/:splat"
 status = 301
 
+[context.production]
+command = "pnpm run check && pnpm build"
+
 [[headers]]
 for = "/*"
 [headers.values]
 X-Content-Type-Options = "nosniff"
 Referrer-Policy = "strict-origin-when-cross-origin"
+
+[context.deploy-preview]
+ignore = "false"