ci: run CI for PRs into dev/flow and build its backend images

.github/workflows/backend-build-tests.yml

@@ -2,9 +2,9 @@ name: Backend build-only regression tests
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev/flow]
   push:
-    branches: [main]
+    branches: [main, dev/flow]
 
 permissions:
   contents: read

.github/workflows/backend.yml

@@ -2,7 +2,8 @@ name: BACKEND - Build, Push and Deploy Image (GHCR)
 
 on:
   push:
-    branches: [main]
+    # dev/flow builds sha-* images for staging. Only main moves `latest`.
+    branches: [main, dev/flow]
     paths:
       - backend/**
       - frontend/src/admin/**

.github/workflows/epic-ci.yml

@@ -6,11 +6,13 @@ on:
       - main
       - dev/312-interim
       - dev/streaming-architecture
+      - dev/flow
   push:
     branches:
       - main
       - dev/312-interim
       - dev/streaming-architecture
+      - dev/flow
 
 # Both checks must exist for every PR, including documentation-only changes.
 # Keep path filters out of this workflow so these names can be required.

.github/workflows/frontend.yml

@@ -7,7 +7,7 @@ on:
       - frontend/**
       - .github/workflows/frontend.yml
   pull_request:
-    branches: [main]
+    branches: [main, dev/flow]
     paths:
       - frontend/**
       - .github/workflows/frontend.yml

.github/workflows/stream-system.yml

@@ -8,15 +8,15 @@ name: STREAM - System test
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev/flow]
     paths:
       - backend/src/**
       - backend/Cargo.toml
       - backend/Cargo.lock
       - docs/stream-rework/prod/**
       - .github/workflows/stream-system.yml
   push:
-    branches: [main]
+    branches: [main, dev/flow]
     paths:
       - backend/src/**
       - backend/Cargo.toml

.github/workflows/tests/backend-build.test.cjs

@@ -27,7 +27,7 @@ function enabled(condition, event, inputs) {
 test('only image build and explicitly requested monitoring jobs remain', () => {
   assert.deepEqual(Object.keys(workflow.jobs).sort(), ['build-and-push', 'deploy-monitoring']);
   assert.deepEqual(Object.keys(workflow.on).sort(), ['push', 'workflow_dispatch']);
-  assert.deepEqual(workflow.on.push.branches, ['main']);
+  assert.deepEqual(workflow.on.push.branches, ['main', 'dev/flow']);
   assert.deepEqual(Object.keys(workflow.on.workflow_dispatch.inputs).sort(), [
     'build',
     'deploy_monitoring',
@@ -171,9 +171,12 @@ test('image summary records the exact image and source without contacting a host
   }
 });
 
-test('regression CI always checks main PRs and pushes without publishing or production access', () => {
+test('regression CI always checks main and dev/flow PRs and pushes without publishing or production access', () => {
   const ci = yaml.load(readFileSync(path.resolve(__dirname, '../backend-build-tests.yml'), 'utf8'));
-  assert.deepEqual(ci.on, { pull_request: { branches: ['main'] }, push: { branches: ['main'] } });
+  assert.deepEqual(ci.on, {
+    pull_request: { branches: ['main', 'dev/flow'] },
+    push: { branches: ['main', 'dev/flow'] },
+  });
   assert.deepEqual(ci.permissions, { contents: 'read' });
   assert.deepEqual(Object.keys(ci.jobs), ['backend-build-tests']);
   const job = ci.jobs['backend-build-tests'];