make qa runners safe for qa

.github/workflows/build-pullrequest.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
     branches:
       - main
+      - qa
     # Review gh actions docs if you want to further define triggers, paths, etc
     # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#on
 

.github/workflows/codeql.yml

@@ -13,10 +13,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ "main" ]
+    branches: [ "main", "qa" ]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ "main" ]
+    branches: [ "main", "qa" ]
   schedule:
     - cron: '39 5 * * 5'
 

.github/workflows/sync-from-reddit.yml

@@ -7,6 +7,15 @@ on:
     - cron: 17,47 * * * *
 
 jobs:
+  sync_matrix:
+    strategy:
+      matrix:
+        branch: [ 'main', 'qa' ]
+        deploy: [ 'yes', 'no' ]
+        exclude:
+          - branch: 'qa'
+          - deploy: 'yes'
+
   sync-from-reddit:
     name: Sync from Reddit
     runs-on: ubuntu-22.04
@@ -15,15 +24,9 @@ jobs:
     permissions:
       contents: write
     steps:
-      - name: Extract branch name
-        shell: bash
-        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
-        id: extract_branch
-
       - uses: actions/checkout@v4
         with:
-          ref: ${{ steps.extract_branch.outputs.branch }}
-
+          - ref: ${{ matrix.branch }}
       - name: Configure git user
         run: |
           git config user.name 'github-actions[bot]'
@@ -56,7 +59,7 @@ jobs:
   deploy:
     name: Deploy site
     needs: sync-from-reddit
-    if: "${{ needs.sync-from-reddit.outputs.new-commit != '' }}"
+    if: "${{ ( needs.sync-from-reddit.outputs.new-commit != '' ) && ( matrix.deploy != 'no' ) }}"
     permissions:
       contents: write
     uses: ./.github/workflows/deploy.yml