ci: keep the release PR's CodeQL scan, require the main base for release-PR skips, gate desktop-live on workspace permissions

Author: waleedlatif1

.github/scripts/desktop-live-changes.sh

@@ -13,7 +13,7 @@ set -u
 
 relevant='^(apps/desktop/|apps/realtime/'\
 '|packages/(desktop-bridge|browser-protocol|terminal-protocol|realtime-protocol|db|auth|emcn|utils|logger|security|platform-authz|runtime-secrets)/'\
-'|apps/sim/lib/(desktop|mothership|uploads|auth|terminal|browser-agent|api/(client|server))/'\
+'|apps/sim/lib/(desktop|mothership|uploads|auth|terminal|browser-agent|workspaces/permissions|api/(client|server))/'\
 '|apps/sim/lib/api/contracts/(chats|copilot|desktop-|mothership-|upload-sessions|workspace-file)'\
 '|apps/sim/app/api/(desktop|mothership|copilot|files|v2/uploads|auth|users/me)/'\
 '|apps/sim/app/api/workspaces/\[id\]/files/'\

.github/workflows/codeql.yml

@@ -85,9 +85,7 @@ jobs:
     # run, so 8 vCPU was 4x more machine than it ever used.
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || 'ubuntu-latest' }}
     timeout-minutes: 60
-    # Not on the staging -> main release pull request: every staging push re-syncs it with code the
-    # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: github.event.pull_request.draft != true && !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.event.pull_request.draft != true
     permissions:
       security-events: write
       contents: read

.github/workflows/desktop-e2e.yml

@@ -61,7 +61,7 @@ jobs:
     name: e2e
     # Not on the staging -> main release pull request: every staging push re-syncs it with code the
     # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.base_ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: macos-26
     timeout-minutes: 30
     steps:
@@ -182,7 +182,7 @@ jobs:
 
   package-smoke:
     name: package-smoke
-    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.base_ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: macos-26
     timeout-minutes: 20
     steps:

.github/workflows/helm.yml

@@ -38,7 +38,7 @@ jobs:
     name: chart
     # Not on the staging -> main release pull request: every staging push re-syncs it with code the
     # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: ${{ !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository) }}
+    if: ${{ !(github.head_ref == 'staging' && github.base_ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository) }}
     runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps: