chore: improve external contributor CI flow

[tomjose92]

Description

Improves the external-contributor pull request experience while preserving the security boundary around secret-bearing CI and deploy-preview workflows.

This change:

• replaces the broken contributor-facing /ok-to-test instructions with a clear Testing section and documented check states;
• adds credential-free fork validation for formatting, lint, type checks, and client, server, and RTS unit tests;
• adds external-contribution state labels and explains when the next action belongs to an Appsmith maintainer;
• adds the maintainer-only /approve-ci command;
• validates the approved PR head and pins client, server, RTS, Docker, and Cypress jobs to one immutable merge commit;
• preserves the existing /ci-test-limit, /test-pw, and /build-deploy-preview commands;
• changes the PR stale policy to 14 days before stale and 14 days before close, while exempting maintainer-blocked and actively tested PRs;
• upgrades actions/stale from v3 to v9.

Internal Appsmith PRs keep using the existing quality-check workflow. The new credential-free validation and external state jobs explicitly skip same-repository PRs.

Security model

The external validation workflow has only:

permissions:
  contents: read
  pull-requests: read

It does not reference repository secrets, write to pull requests, publish images, or access deployment infrastructure. Privileged CI remains maintainer-triggered through the existing GitHub App dispatcher.

/approve-ci records the current PR head, verifies that the checked-out merge commit contains that exact head, and passes the immutable merge SHA to every secret-bearing downstream workflow. A later contributor push requires a new approval.

Testing

• Parsed all changed workflow YAML.
• Ran git diff --check.
• Ran Actionlint against the new and modified workflows.
• Confirmed the credential-free workflow contains no secret references or write permissions.
• Confirmed every checkout-ref caller has a matching reusable-workflow input.
• Compared Actionlint output with the base branch; remaining findings are pre-existing.
• Run a live trial using a PR from a fork before merging.

Notes for reviewers

• The PR template no longer seeds /ok-to-test tags="". Internal maintainers can continue using the existing label-based path, but may want to add a maintainer-only syntax hint to the template.
• The new external Yarn cache currently restores only; the first live trial should measure whether adding a safe cache-save job is worthwhile.
• A second trusted slash command on the same PR cancels the earlier run through the new concurrency group.

Communication

Should the DevRel and Marketing teams inform users about this change?

• Yes
• No

Warning

Tests have not run on the HEAD 7635628 yet

---

Tue, 04 Aug 2026 13:06:50 UTC

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6af3dc74-1011-469d-bd65-22739ee96a7a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/external-contributor-ci-improvements

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}