ci: keep visual-regression baselines refreshing and surface Cypress failures

The baseline job ran Cypress without continue-on-error, so failing a11y/console
assertions aborted the job before the "Push baselines" step — silently freezing
the visual-baselines branch on every merge since the dark/light theme suite
landed. Decouple baseline capture from the assertion gate: Cypress runs with
continue-on-error, the screenshots always flatten and push (if: always()), and a
trailing step fails the job for visibility if Cypress failed. Baselines now
refresh on every merge regardless of the a11y/console outcome.

Also add a "Cypress assertions" pass/fail line to the sticky PR comment so
failures are visible even when the visual diff is clean, and remove the leftover
TEMP diff-demo fixture step and regression-test/cypress/diff-demo/.

Refs: INSTUI-5137

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: balzss

.github/workflows/visual-baselines.yml

@@ -42,7 +42,15 @@ jobs:
         run: npx cypress install
         working-directory: regression-test
 
+      # Capturing baselines is decoupled from the a11y/console assertions: the
+      # screenshots are valid renders regardless of whether those assertions
+      # pass, so a failing test must never block the baseline refresh (that's
+      # what silently froze the baselines branch before). We let Cypress fail
+      # here, always publish the screenshots below, then re-surface the failure
+      # in a trailing step so master still shows red and notifies.
       - name: Run Cypress
+        id: cypress
+        continue-on-error: true
         uses: cypress-io/github-action@v7
         env:
           ELECTRON_EXTRA_LAUNCH_ARGS: "--remote-debugging-port=9222"
@@ -53,11 +61,13 @@ jobs:
           working-directory: regression-test
 
       - name: Flatten screenshots
+        if: always()
         run: |
           mkdir -p baseline-publish/screenshots
           find regression-test/cypress/screenshots -name '*.png' -exec cp {} baseline-publish/screenshots/ \;
 
       - name: Push baselines to visual-baselines branch
+        if: always()
         run: |
           cd baseline-publish
           git init -b visual-baselines
@@ -67,3 +77,12 @@ jobs:
           git commit -m "update baselines from ${GITHUB_SHA}"
           git remote add origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git"
           git push --force origin visual-baselines
+
+      # Baselines have been refreshed by this point; now fail loudly if the
+      # suite had regressions (a11y/console violations or a broken page) so the
+      # failure is visible on master rather than silently swallowed.
+      - name: Fail if Cypress reported failures
+        if: steps.cypress.outcome == 'failure'
+        run: |
+          echo "::error::Baselines were published, but the regression suite had failing tests (a11y/console/spec). See the Run Cypress step logs."
+          exit 1

.github/workflows/visual-regression.yml

@@ -77,19 +77,6 @@ jobs:
           mkdir -p regression-test/.actual
           find regression-test/cypress/screenshots -name '*.png' -exec cp {} regression-test/.actual/ \;
 
-      # TEMP (remove before merge): this PR renames every screenshot with a
-      # `-<theme>` suffix, so nothing matches the old baselines and the report
-      # has zero "changed" rows — leaving the new diff visualization impossible
-      # to preview. Inject one synthetic baseline/actual pair that differs in a
-      # few localized spots so the report always has a "changed" example.
-      # Fixtures live in regression-test/cypress/diff-demo/. Delete this step
-      # and that directory to revert.
-      - name: TEMP inject diff-demo fixture
-        run: |
-          mkdir -p regression-test/.baselines regression-test/.actual
-          cp regression-test/cypress/diff-demo/baseline.png regression-test/.baselines/diff-demo.png
-          cp regression-test/cypress/diff-demo/actual.png regression-test/.actual/diff-demo.png
-
       - name: Diff and generate report
         id: diff
         working-directory: regression-test
@@ -173,7 +160,9 @@ jobs:
           message: |
             ## Visual regression report
 
-            ${{ steps.summary.outputs.status }}
+            **Cypress assertions (a11y + console errors):** ${{ steps.cypress.outcome == 'failure' && format('❌ **Failing** — see the [run logs]({0}/{1}/actions/runs/{2}).', github.server_url, github.repository, github.run_id) || '✅ Passing' }}
+
+            **Visual diff:** ${{ steps.summary.outputs.status }}
 
             | Status | Count |
             |---|---|
@@ -186,7 +175,7 @@ jobs:
 
             ${{ steps.summary.outputs.diff_images }}
 
-            <sub>Baselines come from the `visual-baselines` branch. They refresh on every merge to `master`.</sub>
+            <sub>Baselines come from the `visual-baselines` branch. They refresh on every merge to `master`. The <b>Cypress assertions</b> line above covers a11y (axe) and console-error checks — a ❌ there means the suite found real issues even if the visual diff is clean.</sub>
 
       - name: Fail if regressions or Cypress failed
         if: steps.diff.outcome == 'failure' || steps.cypress.outcome == 'failure'