[rezrah]

Summary

Towards unblocking #1520

Contributions from forks are not able to clear CI easily enough. See above for an example ☝️

This PR adds parallel workflows to allow CI gates to clear on forks, while splitting and hardening our maintainer-only workflows for continuity.

List of notable changes:

• Added read-only CI workflows for forks
• Upload certain CI outputs for forks to Actions
• Harden token permissions and checkout credentials in main workflows

Steps to test:

1. Check this fork test passes 🚧 Testing forks in CI #1526
2. Check this PR's CI continues to clear 🟢

Contributor checklist:

• All new and existing CI checks pass
• Tests prove that the feature works and covers both happy and unhappy paths
• Any drop in coverage, breaking changes or regressions have been documented above
• UI Changes contain new visual snapshots (generated by adding update snapshots label to the PR)
• All developer debugging and non-functional logging has been removed
• Related issues have been referenced in the PR description

Reviewer checklist:

• Check that pull request and proposed changes adhere to our contribution guidelines and code of conduct
• Check that tests prove the feature works and covers both happy and unhappy paths
• Check that there aren't other open Pull Requests for the same update/change

Screenshots:

N/A

[changeset-bot]

⚠️ No Changeset found

Latest commit: eceb836

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🟢 No design token changes found

[Copilot]

🔵 Needs a closer look

End-to-end fork validation remains pending, leaving repository-specific approval behavior, larger macOS runner access, and required-check routing unverified.

No open issues 🎉

What changed in this PR

This PR separates fork CI from workflows that need write access, aiming to unblock contributions such as #1520 while preserving maintainer automation.

Changes:

• Add read-only fork workflows with summaries and downloadable reports; fork visual-test failures are explicitly nonblocking.
• Restrict write-enabled workflows to same-repository pull requests, narrow token permissions, and disable persisted checkout credentials where applicable.
• Document maintainer approval expectations for running untrusted fork code.

File	Description
CONTRIBUTING.md	Update CI expectations and document fork workflow approval.
.github/​workflows/​visual_test_storybook.yml	Restrict commenting workflow to same-repository PRs and harden access.
.github/​workflows/​visual_test_storybook_forks.yml	Add nonblocking fork visual tests with report artifacts.
.github/​workflows/​update_visual_snapshots.yml	Restrict snapshot updates to open, same-repository PRs.
.github/​workflows/​ui_test_primitives_diff.yml	Restrict commenting workflow and disable persisted credentials.
.github/​workflows/​ui_test_primitives_diff_forks.yml	Add read-only token comparison reports for forks.
.github/​workflows/​ui_test_diff_comment.yml	Restrict coverage comments to same-repository PRs and harden access.
.github/​workflows/​ui_test_diff_comment_forks.yml	Add fork coverage summaries and report artifacts.
.github/​workflows/​ui_test_accessibility.yml	Set read-only permissions and disable persisted credentials.
.github/​workflows/​integration_test_nextjs.yml	Harden permissions and checkout for Next.js integration tests.
.github/​workflows/​integration_test_astro.yml	Harden permissions and checkout for Astro integration tests.
.github/​workflows/​deploy_docs_preview.yml	Restrict previews to same-repository PRs and narrow permissions.
.github/​workflows/​deploy_docs_preview_forks.yml	Clarify base-preview naming and narrow permissions.
.github/​workflows/​ci.yml	Set read-only permissions and disable persisted credentials.
.github/​workflows/​bundle_size.yml	Restrict commenting workflow, harden access, and pin the comment action.
.github/​workflows/​bundle_size_forks.yml	Add read-only bundle-size summaries and artifacts for forks.

_{Review effort: Balanced}

[github-actions]

🟢 No unit test coverage changes found

All components and hooks with tests maintain the same coverage as the main branch.

[github-actions]

🟢 Bundle size report

Check	Main	Branch	Change
UMD — full bundle (JS)	111.90 kB	111.90 kB	🟢 No change
UMD — full bundle (CSS)	75.99 kB	75.99 kB	🟢 No change
ESM — full bundle (JS + CSS)	187.49 kB	187.49 kB	🟢 No change
ESM — tree-shaken simple (Button, JS + CSS)	9.34 kB	9.34 kB	🟢 No change
ESM — tree-shaken complex (ActionMenu, JS + CSS)	26.08 kB	26.08 kB	🟢 No change

[github-actions]

🟢 No visual differences found

Our visual comparison tests did not find any differences in the UI.

[Copilot]

🟡 Changes recommended

Deletion-only CSS variable changes produce no diff.md, causing the workflow to falsely report no design-token changes to fork reviewers.

1 open issue

• Report deletion-only design-token diffs · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The baseline failure fallback substitutes an empty baseline, causing existing bundles to appear as new with a green heading and potentially masking size regressions.

1 open issue

• Report baseline measurement failures instead of treating baseline as empty · New

1 resolved since last review

• Report deletion-only design-token diffs

_{Review effort: Balanced}