ci: make Chromatic visual check a real approval gate

Set exitZeroOnChanges: false on the required visual-tests job so PRs with
unaccepted visual changes fail the check until a maintainer accepts them in
Chromatic and re-runs the job.

Add a pull_request_target reporter that posts the required
"Visual regression (Chromatic)" status as success for dev PRs that touch no
UI code. This unblocks content-only PRs -- including fork PRs whose CI
workflow is held for manual approval and therefore never reports the check
(e.g. #18806).

Author: pettinarip

.github/workflows/chromatic-required-status.yml

@@ -0,0 +1,55 @@
+name: Chromatic required status
+
+# Satisfies the required "Visual regression (Chromatic)" status check for dev PRs
+# that touch no UI code. The CI `visual-tests` job is skipped for such PRs, and
+# for fork PRs the whole CI workflow is held for manual approval -- so without
+# this reporter the required check is never posted and the PR is blocked forever
+# (e.g. content-only fork PRs).
+#
+# Runs as pull_request_target so it executes in the base-repo context with a
+# token that can post commit statuses, without approval. It only reads the PR's
+# changed-file list -- it never checks out or executes fork code.
+
+on:
+  pull_request_target:
+    branches: [dev]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: read
+  statuses: write
+
+concurrency:
+  group: chromatic-required-status-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  report:
+    name: Report Chromatic status for non-UI PRs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Mark non-UI PRs as passing
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          # Keep in sync with the `chromatic-gate` path filter in ci.yml.
+          UI_REGEX='^(src/components/|src/layouts/|src/styles/|app/|\.storybook/|package\.json$|pnpm-lock\.yaml$)'
+
+          files=$(gh api --paginate "repos/${REPO}/pulls/${PR}/files" --jq '.[].filename')
+
+          if echo "$files" | grep -qE "$UI_REGEX"; then
+            echo "UI files changed -- the CI visual-regression job owns the required check."
+            exit 0
+          fi
+
+          echo "No UI files changed -- reporting the required Chromatic check as passed."
+          gh api "repos/${REPO}/statuses/${SHA}" \
+            -f state=success \
+            -f context='Visual regression (Chromatic)' \
+            -f description='No UI changes — visual review not required'

.github/workflows/ci.yml

@@ -113,7 +113,9 @@ jobs:
         uses: chromaui/action@v16
         with:
           projectToken: fee8e66c9916
-          exitZeroOnChanges: true
+          # Fail the check when unaccepted visual changes exist, so a maintainer
+          # must accept them in Chromatic (then re-run this job) before merge.
+          exitZeroOnChanges: false
           onlyChanged: true
           # Release-train builds (dev/staging/master head branches) were
           # already reviewed per-PR on dev; auto-accept them as baselines.