chore: update-fork-flow

Author: ryanbas21

.github/actions/publish-beta/action.yml

@@ -1,6 +1,5 @@
 name: 'Publish Beta Steps'
 description: 'Steps to run when packages are not published (beta branch)'
-inputs:
 
 runs:
   using: 'composite'

.github/actions/setup/action.yml

@@ -1,6 +1,10 @@
 name: 'Setup Project'
 description: 'Centralized setup for CI jobs'
 inputs:
+  branch:
+    description: 'Branch/ref to publish from'
+    required: false
+    default: 'main'
   fetch-depth:
     description: 'Git fetch depth'
     required: false
@@ -23,6 +27,7 @@ runs:
       with:
         fetch-depth: ${{ inputs.fetch-depth }}
         token: ${{ inputs.token }}
+        ref: ${{ inputs.branch }}
 
     - uses: pnpm/action-setup@v4
       with:

.github/workflows/ci-fork.yml

@@ -1,17 +1,27 @@
 name: ForgeRock Fork Pull Request CI
+
 on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-    branches:
-      - main
+  pull_request:
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   pr:
+    # Only run for forks
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
+
     steps:
       - uses: actions/checkout@v4
         with:
+          # head commit is fine; the default merge ref also works on pull_request
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
@@ -20,26 +30,28 @@ jobs:
           run_install: false
 
       - uses: actions/setup-node@v4
-        id: cache
         with:
           node-version-file: '.node-version'
           cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
 
       - run: pnpm install --frozen-lockfile
 
-      - name: Cache Playwright browsers
-        uses: actions/cache@v4
+      # Restore-only cache to avoid save attempts/noise on forks
+      - name: Restore Playwright browsers cache
+        uses: actions/cache/restore@v4
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('**/pnpm-lock.yaml') }}
           restore-keys: |
             ${{ runner.os }}-playwright-
 
-      - run: pnpm exec playwright install
+      - run: pnpm exec playwright install --with-deps
 
       - uses: nrwl/nx-set-shas@v4
-      # This line is needed for nx affected to work when CI is running on a PR
-      - run: git branch --track main origin/main
+
+      # Needed so nx affected can diff against main
+      - run: git branch --track main origin/main || true
 
       - run: pnpm nx format:check
       - run: pnpm nx affected -t build typecheck lint test e2e-ci

.github/workflows/ci.yml

@@ -16,6 +16,7 @@ concurrency:
 
 jobs:
   pr:
+    if: ${{github.event.pull_request.head.repo.full_name == github.repository}}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
@@ -37,8 +38,6 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
-      # This line enables distribution
-      # The "--stop-agents-after" is optional, but allows idle agents to shut down once the "e2e-ci" targets have been requested
       - run: pnpm dlx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yml" --stop-agents-after="e2e-ci" --with-env-vars="CODECOV_TOKEN"
       - run: pnpm nx sync:check
 

.github/workflows/publish.yml

@@ -49,14 +49,6 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.GH_TOKEN }}
 
-      - uses: actions/setup-node@v5
-        id: cache
-        with:
-          node-version-file: '.node-version'
-          pnpm-cache-folder: .pnpm-store
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
       - name: publish
         uses: changesets/action@v1
         id: changesets
@@ -81,14 +73,6 @@ jobs:
       - name: Publish Beta Steps
         if: steps.changesets.outputs.published == 'false'
         uses: ./.github/actions/publish-beta
-        with:
-          branch: main
-
-      - uses: JamesIves/github-pages-deploy-action@v4.7.3
-        with:
-          folder: docs
-          commit-message: 'chore: release-api-docs-beta'
-          target-folder: 'beta'
 
       - name: Calculate baseline bundle sizes
         run: |