test gated workflow

Author: wenxi-onyx

.github/workflows/community-prs-ok-to-test.yaml

@@ -0,0 +1,24 @@
+name: Community PRs – Approved to Run Workflows
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  run-with-approval:
+    if: >
+      github.event.pull_request.head.repo.fork == true &&
+      contains(github.event.pull_request.labels.*.name, 'run-workflows')
+
+    environment: external-prs   # approval gate; no env secrets needed
+
+    uses: ./github/workflows/pr-playwright-tests.yml
+    with:
+      pr_repo: ${{ github.event.pull_request.head.repo.full_name }}
+      pr_sha:  ${{ github.event.pull_request.head.sha }}
+      # If your policy forbids forks on self-hosted runners, uncomment:
+      # runner: '["ubuntu-latest"]'
+    secrets: inherit

.github/workflows/pr-playwright-tests.yml

@@ -1,10 +1,27 @@
 name: Run Playwright Tests
+
+on:
+  push:            # Internal runs
+  workflow_call:   # Allows a caller to run this against a fork/community PR
+    inputs:
+      pr_repo:
+        type: string
+        required: false
+        default: ${{ github.repository }}
+      pr_sha:
+        type: string
+        required: false
+        default: ${{ github.sha }}
+      # Optional: let the caller switch runners for forks
+      runner:
+        type: string
+        required: false
+        default: '["runs-on","runner=32cpu-linux-x64","disk=large","run-id=${{ github.run_id }}"]'
+
 concurrency:
   group: Run-Playwright-Tests-${{ github.workflow }}-${{ github.head_ref || github.event.workflow_run.head_branch || github.run_id }}
   cancel-in-progress: true
-
-on: push
-
+  
 env:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
   SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}