ci: improve workflows

.github/workflows/backend-image.yml

@@ -1,6 +1,8 @@
 name: Backend image
 
 # Runs when backend/ or the build workflow changes. Use "Manual image publish" to force a build.
+# Pull requests into develop only run the checks; the image build (~6 min, arm64 under QEMU) waits for the
+# develop -> main pull request, which still builds it before anything is released.
 on:
   push:
     branches: [main]
@@ -25,6 +27,8 @@ jobs:
   # The full backend suite against real Postgres, including end-to-end provider imports. The image
   # is only built and published if this passes.
   test:
+    # A main -> develop back-merge only brings release commits main already tested.
+    if: github.head_ref != 'main'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -57,6 +61,9 @@ jobs:
           cache-dependency-path: backend/package-lock.json
       - run: npm ci --no-audit --no-fund
       - run: npx prisma generate
+      - run: npm run lint
+      # tsc: the typecheck the image build would otherwise be the only one to run.
+      - run: npm run build
       - run: npx prisma migrate deploy
       - run: npm test
 
@@ -75,7 +82,9 @@ jobs:
   build:
     needs: [test, release]
     # Also when the release was skipped, as on pull requests; never after a failed one.
-    if: ${{ !cancelled() && needs.test.result == 'success' && needs.release.result != 'failure' }}
+    if: >-
+      ${{ !cancelled() && needs.test.result == 'success' && needs.release.result != 'failure'
+      && !(github.event_name == 'pull_request' && github.base_ref == 'develop') }}
     permissions:
       contents: read
       packages: write

.github/workflows/bridge-release.yml

@@ -21,6 +21,8 @@ concurrency:
 
 jobs:
   build-windows:
+    # A main -> develop back-merge only brings release commits main already tested.
+    if: github.head_ref != 'main'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -44,6 +46,8 @@ jobs:
           if-no-files-found: error
 
   build-linux:
+    # A main -> develop back-merge only brings release commits main already tested.
+    if: github.head_ref != 'main'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -67,6 +71,8 @@ jobs:
           if-no-files-found: error
 
   build-macos:
+    # A main -> develop back-merge only brings release commits main already tested.
+    if: github.head_ref != 'main'
     # macOS URL-scheme handling needs cgo and Cocoa, so it can't be cross-compiled.
     runs-on: macos-latest
     steps:

.github/workflows/extension-release.yml

@@ -23,6 +23,8 @@ concurrency:
 
 jobs:
   build-chrome:
+    # A main -> develop back-merge only brings release commits main already tested.
+    if: github.head_ref != 'main'
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -53,6 +55,8 @@ jobs:
           if-no-files-found: error
 
   build-firefox:
+    # A main -> develop back-merge only brings release commits main already tested.
+    if: github.head_ref != 'main'
     runs-on: ubuntu-latest
     defaults:
       run:

.github/workflows/format.yml

@@ -11,6 +11,8 @@ permissions:
 
 jobs:
   check:
+    # A main -> develop back-merge only brings release commits main already tested.
+    if: github.head_ref != 'main'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/frontend-image.yml

@@ -1,6 +1,8 @@
 name: Frontend image
 
 # Runs when frontend/ or the build workflow changes. Use "Manual image publish" to force a build.
+# Pull requests into develop only run the checks; the image build waits for the develop -> main pull request,
+# which still builds it before anything is released.
 on:
   push:
     branches: [main]
@@ -22,8 +24,30 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  # Typecheck, lint, tests and a production build, natively. The image build skips the Dockerfile's test
+  # stage, so this is the only place the frontend tests run.
+  verify:
+    # A main -> develop back-merge only brings release commits main already tested.
+    if: github.head_ref != 'main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - run: npm ci --no-audit --no-fund
+      - run: npm run verify
+
   # A merge into main may give the frontend a new version (release-project.yml); the image is built from it.
   release:
+    needs: verify
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: write
@@ -34,9 +58,11 @@ jobs:
     secrets: inherit
 
   build:
-    needs: release
+    needs: [verify, release]
     # Also when the release was skipped, as on pull requests; never after a failed one.
-    if: ${{ !cancelled() && needs.release.result != 'failure' }}
+    if: >-
+      ${{ !cancelled() && needs.verify.result == 'success' && needs.release.result != 'failure'
+      && !(github.event_name == 'pull_request' && github.base_ref == 'develop') }}
     permissions:
       contents: read
       packages: write

.github/workflows/web-pages.yml

@@ -52,6 +52,8 @@ env:
 
 jobs:
   build:
+    # A main -> develop back-merge only brings release commits main already tested.
+    if: github.head_ref != 'main'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4