Start PR checks on bot-created PRs

.github/workflows/gardener-backlog-prs.yml

@@ -19,14 +19,13 @@ env:
   PNPM_VERSION: '10.11.1'
   SHOPIFY_CLI_ENV: development
   SHOPIFY_CONFIG: debug
+  ISSUE_BRANCH: gardener-backlog-${{ github.run_id }}
 
 jobs:
   gardener:
     if: github.repository == 'Shopify/cli'
     runs-on: ubuntu-latest
     timeout-minutes: 120
-    env:
-      ISSUE_BRANCH: gardener-backlog-${{ github.run_id }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -138,3 +137,35 @@ jobs:
           method: chat.postMessage
           token: ${{ secrets.SLACK_GARDENER_BOT_TOKEN }}
           payload: ${{ steps.pull-request.outputs.payload }}
+
+  start-pr-checks:
+    name: Start PR checks
+    needs: gardener
+    if: ${{ !cancelled() && github.repository == 'Shopify/cli' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # A separate job keeps actions: write away from the agent, which could
+    # otherwise dispatch other workflows such as release.yml.
+    permissions:
+      actions: write
+      pull-requests: read
+    steps:
+      - name: Dispatch PR checks
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          # PRs opened with GITHUB_TOKEN don't trigger pull_request workflows.
+          script: |
+            const {data: pullRequests} = await github.rest.pulls.list({
+              ...context.repo,
+              state: 'open',
+              head: `${context.repo.owner}:${process.env.ISSUE_BRANCH}`,
+              base: context.payload.repository.default_branch,
+            });
+            if (pullRequests.length === 0) return;
+
+            await github.rest.actions.createWorkflowDispatch({
+              ...context.repo,
+              workflow_id: 'tests-pr.yml',
+              ref: process.env.ISSUE_BRANCH,
+            });
+            core.info(`Dispatched PR checks for ${pullRequests[0].html_url}`);

.github/workflows/maintenance-prs.yml

@@ -142,3 +142,39 @@ jobs:
           method: chat.postMessage
           token: ${{ secrets.SLACK_GARDENER_BOT_TOKEN }}
           payload: ${{ steps.pull-request.outputs.payload }}
+
+  start-pr-checks:
+    name: Start PR checks
+    needs: maintenance
+    if: ${{ !cancelled() && github.repository == 'Shopify/cli' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # A separate job keeps actions: write away from the agent, which could
+    # otherwise dispatch other workflows such as release.yml.
+    permissions:
+      actions: write
+      pull-requests: read
+    steps:
+      - name: Dispatch PR checks
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          # PRs opened with GITHUB_TOKEN don't trigger pull_request workflows.
+          script: |
+            const pullRequests = await github.paginate(github.rest.pulls.list, {
+              ...context.repo,
+              state: 'open',
+              base: context.payload.repository.default_branch,
+            });
+            const branchSuffix = `-maintenance-${context.runId}`;
+            const maintenancePullRequests = pullRequests.filter((pullRequest) =>
+              pullRequest.head.repo?.full_name === `${context.repo.owner}/${context.repo.repo}` &&
+              pullRequest.head.ref.endsWith(branchSuffix));
+
+            for (const pullRequest of maintenancePullRequests) {
+              await github.rest.actions.createWorkflowDispatch({
+                ...context.repo,
+                workflow_id: 'tests-pr.yml',
+                ref: pullRequest.head.ref,
+              });
+              core.info(`Dispatched PR checks for ${pullRequest.html_url}`);
+            }

.github/workflows/tests-pr.yml

@@ -3,6 +3,9 @@ name: PR
 on:
   pull_request:
   merge_group:
+  # Bot PRs opened with GITHUB_TOKEN don't trigger pull_request, so their
+  # workflows dispatch this one on the PR branch.
+  workflow_dispatch:
 
 concurrency:
   group: shopify-cli-${{ github.head_ref || github.run_id }}
@@ -93,8 +96,8 @@ jobs:
   graphql-schema:
     # Skip on dependabot PRs (no access to required secrets) and on PRs opened
     # from forks (also no access to secrets), but always run on merge_group
-    # events since merge queue runs from the base repo.
-    if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && (github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name == github.repository) }}
+    # and workflow_dispatch events since both run from the base repo.
+    if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository) }}
     name: 'Check graphql-codegen has been run'
     runs-on: macos-latest
     timeout-minutes: 30