chore: extract/consolidate contributor pr workflow

[cacieprins]

• Closes

Additional details

Previously, we had an entirely separate workflow defined for contributor pull requests. This was implemented in order to require maintainer approval for running expensive CI jobs on contributor pull requests.

This consolidates the contributor PR into the primary pull-request workflow, while keeping the same behavior.

The node_modules_install, build, check-ts, lint, and lint-types jobs will still run for external contributors. Any subsequent jobs require that the approve-contributor-pr job be approved by a maintainer. Because the approve-contributor-pr job is conditional based on the branch pattern, declaring it as required for subsequent jobs will only be enforced if that job runs - internal contributor/maintainer PRs will not run that job, so it will be skipped as required.

Steps to test

Fork this branch to another account, and open a pull request. Verify that it prevents expensive jobs from running prior to approval.

How has the user experience changed?

PR Tasks

• [NA] Have tests been added/updated?
• [NA] Has a PR for user-facing changes been opened in cypress-documentation?
• [NA] Have API changes been updated in the type definitions?

---

Note

Consolidates contributor PR handling into the main pull-request workflow with an approval gate, removes the separate contributor workflow, and infers contributor PR status from branch name during env checks.

• CI (CircleCI Workflows)
  • Contributor Flow Consolidation: Removes linux-x64-contributor workflow from workflows/@main.yml and folds contributor handling into workflows/pull-request.yml.
    • Adds internal-pr-build and external-pr-build jobs with branch filters.
    • Introduces approve-contributor-pr approval gate required by expensive/restricted jobs.
    • Updates downstream job requirements to depend on the appropriate build (internal/external) and approval.
    • Moves finalization steps (percy-finalize, verify-accessibility-results) to a dedicated finalization section.
• Pipeline
  • Contributor Detection: Replaces build job parameter is_contributor_pr by deriving it from << pipeline.git.branch >> and passing to circle-env.js.

^{Written by Cursor Bugbot for commit 239b603. This will update automatically on new commits. Configure here.}

[cypress]

cypress    Run #66147

Run Properties:   Passed #66147  •  239b603134: does not use context for contrib prs

Project	cypress
Branch Review	ci/extract-contributor-workflow
Run status	Passed #66147
Run duration	19m 40s
Commit	239b603134: does not use context for contrib prs
Committer	Cacie Prins
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	14
Pending	1102
Skipped	0
Passing	26665
View all changes introduced in this branch ↗︎

UI Coverage  45.11%
Untested elements	186
Tested elements	157

Accessibility  97.76%
Failed rules	4 critical   8 serious   2 moderate   2 minor
Failed elements	110

[AtofStryker]

@cacieprins I created #32574 to test this workflow out and job is running on https://app.circleci.com/pipelines/github/cypress-io/cypress/75143

[cacieprins]

@cacieprins I created #32574 to test this workflow out and job is running on https://app.circleci.com/pipelines/github/cypress-io/cypress/75143

Correct - this is the same pattern as the old linux-x64-contributor-pr. It will run node_modules_install, build, check-ts, lint and lint-types and wait for approval before running anything else

[AtofStryker]

@cacieprins I think the jobs lacking the approval button are automatically locked

it looks to still be automatically locked after clicking approve and the workflow automatically fails

[AtofStryker]

@cacieprins I'm running a contributor PR running against the branch https://app.circleci.com/pipelines/github/cypress-io/cypress/75579