ci: use Nx Cloud only on main, run PRs locally

[fwal]

Problem

PRs from external contributors fail CI because GitHub does not expose repository secrets to workflows triggered by PRs from forks. As a result NX_CLOUD_ACCESS_TOKEN is empty on those runs, and the nx-cloud start-ci-run distribution step fails when it tries to authenticate.

Change

Stop depending on the Nx Cloud access token for pull requests. Nx Cloud (task distribution + remote cache writes) now runs only on pushes to main; all pull requests — from this repo or a fork — run nx affected locally.

Trigger	Distribution (start-ci-run)	Cache reads	Cache writes
Push to main	✅	✅	✅
Any PR (own or fork)	❌ skipped	❌ (NX_NO_CLOUD)	❌

Concretely:

• The start-ci-run step is gated on github.event_name == 'push' (only main, per the workflow triggers).
• The nx affected step sets NX_NO_CLOUD for pull_request events, so PRs run tasks on the runner and never reference the token.

Why this approach

• No fork special-casing and no token exposed on any PR run — contributor PRs pass.
• The remote cache is still populated on every merge to main, so local dev machines and main CI keep benefiting from it.
• Avoids pull_request_target, which would run untrusted fork code with a write-capable GITHUB_TOKEN in scope.

Trade-off: PR CI runs cold (no remote-cache reads). Negligible at this repo's size; can be revisited later by embedding a read-only token for cache reads if PR times grow.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LKPMobWjRwcz9TDzS3Kryp

---

Generated by Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved pull request validation by running Nx tasks locally when cloud access is unavailable.
  • Restricted distributed task execution to push-based workflows, increasing CI reliability for pull requests and forks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4435c2e4-1e7e-4f65-b968-2bca94ee79f6

📥 Commits

Reviewing files that changed from the base of the PR and between 95194e2 and b70d4ff.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The CI workflow now runs Nx Cloud task distribution only for push events and disables Nx Cloud during pull request events through NX_NO_CLOUD.

Changes

Nx Cloud CI behavior

Layer / File(s)	Summary
Event-based Nx Cloud controls .github/workflows/ci.yml	Nx Cloud distribution is restricted to push events, while NX_NO_CLOUD disables Nx Cloud for pull_request events.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Poem

I’m a small rabbit guarding the run,
Pushes may cloud-hop beneath the sun.
Pull requests stay local, steady and bright,
No token troubles in the night.
Hop, hop—clean CI feels just right!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the CI change: Nx Cloud is limited to main pushes and pull requests run locally.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}