From d230180b49d695575edeb075dbf3e74f8c30e21e Mon Sep 17 00:00:00 2001
From: anneoneone <49155143+anneoneone@users.noreply.github.com>
Date: Tue, 3 Nov 2026 01:55:44 +0100
Subject: [PATCH] ci: run CI for PRs into dev/flow and build its backend images

R0 to R5 are built on dev/flow so main stays releasable. PRs into
dev/flow now run backend-ci, frontend-ci, backend-build-tests, the
frontend build and stream-system. Pushes to dev/flow build sha-* images
for staging; latest still moves only on main, and no deploy runs from
dev/flow.

Refs: https://github.com/phaabe/live.moafunk.de/issues/838
---
 .github/workflows/backend-build-tests.yml      | 4 ++--
 .github/workflows/backend.yml                  | 3 ++-
 .github/workflows/epic-ci.yml                  | 2 ++
 .github/workflows/frontend.yml                 | 2 +-
 .github/workflows/stream-system.yml            | 4 ++--
 .github/workflows/tests/backend-build.test.cjs | 9 ++++++---
 6 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/backend-build-tests.yml b/.github/workflows/backend-build-tests.yml
index 25183e6..954f590 100644
--- a/.github/workflows/backend-build-tests.yml
+++ b/.github/workflows/backend-build-tests.yml
@@ -2,9 +2,9 @@ name: Backend build-only regression tests
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev/flow]
   push:
-    branches: [main]
+    branches: [main, dev/flow]
 
 permissions:
   contents: read
diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index 24b0d37..1f6b2f9 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -2,7 +2,8 @@ name: BACKEND - Build, Push and Deploy Image (GHCR)
 
 on:
   push:
-    branches: [main]
+    # dev/flow builds sha-* images for staging. Only main moves `latest`.
+    branches: [main, dev/flow]
     paths:
       - backend/**
       - frontend/src/admin/**
diff --git a/.github/workflows/epic-ci.yml b/.github/workflows/epic-ci.yml
index ad34749..6ae5e66 100644
--- a/.github/workflows/epic-ci.yml
+++ b/.github/workflows/epic-ci.yml
@@ -6,11 +6,13 @@ on:
       - main
       - dev/312-interim
       - dev/streaming-architecture
+      - dev/flow
   push:
     branches:
       - main
       - dev/312-interim
       - dev/streaming-architecture
+      - dev/flow
 
 # Both checks must exist for every PR, including documentation-only changes.
 # Keep path filters out of this workflow so these names can be required.
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index eb4650e..f1ae2d0 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -7,7 +7,7 @@ on:
       - frontend/**
       - .github/workflows/frontend.yml
   pull_request:
-    branches: [main]
+    branches: [main, dev/flow]
     paths:
       - frontend/**
       - .github/workflows/frontend.yml
diff --git a/.github/workflows/stream-system.yml b/.github/workflows/stream-system.yml
index 0044526..1a4939e 100644
--- a/.github/workflows/stream-system.yml
+++ b/.github/workflows/stream-system.yml
@@ -8,7 +8,7 @@ name: STREAM - System test
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev/flow]
     paths:
       - backend/src/**
       - backend/Cargo.toml
@@ -16,7 +16,7 @@ on:
       - docs/stream-rework/prod/**
       - .github/workflows/stream-system.yml
   push:
-    branches: [main]
+    branches: [main, dev/flow]
     paths:
       - backend/src/**
       - backend/Cargo.toml
diff --git a/.github/workflows/tests/backend-build.test.cjs b/.github/workflows/tests/backend-build.test.cjs
index a2aba68..4c9d339 100644
--- a/.github/workflows/tests/backend-build.test.cjs
+++ b/.github/workflows/tests/backend-build.test.cjs
@@ -27,7 +27,7 @@ function enabled(condition, event, inputs) {
 test('only image build and explicitly requested monitoring jobs remain', () => {
   assert.deepEqual(Object.keys(workflow.jobs).sort(), ['build-and-push', 'deploy-monitoring']);
   assert.deepEqual(Object.keys(workflow.on).sort(), ['push', 'workflow_dispatch']);
-  assert.deepEqual(workflow.on.push.branches, ['main']);
+  assert.deepEqual(workflow.on.push.branches, ['main', 'dev/flow']);
   assert.deepEqual(Object.keys(workflow.on.workflow_dispatch.inputs).sort(), [
     'build',
     'deploy_monitoring',
@@ -171,9 +171,12 @@ test('image summary records the exact image and source without contacting a host
   }
 });
 
-test('regression CI always checks main PRs and pushes without publishing or production access', () => {
+test('regression CI always checks main and dev/flow PRs and pushes without publishing or production access', () => {
   const ci = yaml.load(readFileSync(path.resolve(__dirname, '../backend-build-tests.yml'), 'utf8'));
-  assert.deepEqual(ci.on, { pull_request: { branches: ['main'] }, push: { branches: ['main'] } });
+  assert.deepEqual(ci.on, {
+    pull_request: { branches: ['main', 'dev/flow'] },
+    push: { branches: ['main', 'dev/flow'] },
+  });
   assert.deepEqual(ci.permissions, { contents: 'read' });
   assert.deepEqual(Object.keys(ci.jobs), ['backend-build-tests']);
   const job = ci.jobs['backend-build-tests'];