[PR-A/Phase 2] Add develop to pull_request triggers across all 15 workflows #159

Problem

All 15 workflows in .github/workflows/ filter pull_request.branches to either [rebuild] or [main, rebuild]. ZERO include develop. A PR targeting develop fires zero workflow runs on its head SHA via the pull_request event.

PR #155 was a 583-file PR targeting develop — and CI ran only via push events to rebuild. All PR-only checks (Dependency Review, SonarCloud PR Comment, OSV scan-pr, CodeRabbit) were silently skipped.

Fix

Add develop to pull_request.branches in every workflow. Do NOT add to push triggers (would cause double-runs when merging).

Affected files (mechanical edit, same pattern):

# BEFORE
on:
  pull_request:
    branches: [rebuild]

# AFTER
on:
  pull_request:
    branches: [rebuild, develop]

Files to update (parallelizable):

• .github/workflows/ci.yml — [main, rebuild] → [main, rebuild, develop]
• .github/workflows/server-ci.yml — [rebuild] → [rebuild, develop]
• .github/workflows/cli-ci.yml
• .github/workflows/desktop-ci.yml
• .github/workflows/droplet-ci.yml
• .github/workflows/e2e.yml
• .github/workflows/codeql.yml
• .github/workflows/osv-scanner.yml
• .github/workflows/editorconfig-ci.yml
• .github/workflows/open-code-review.yml
• .github/workflows/desktop-main-ci.yml (verify exists first via gh api)
• .github/workflows/sites-ci.yml (verify exists first via gh api)

Strategy Notes

• Keep push.branches: [main, rebuild] (or [rebuild]) unchanged to avoid double-runs
• For osv-scanner.yml, merge_group event also needs develop added
• For codeql.yml, both push + pull_request blocks need develop

Verification Gate

# Draft PR targeting develop with a trivial change
gh pr create --base develop --head remediation/test-target \
  --title "test: verify workflow triggers" --body "Phase 2 verification" --draft

# Wait 60s, then verify
gh run list --workflow ci.yml --branch remediation/test-target
gh run list --workflow server-ci.yml --branch remediation/test-target
gh run list --workflow codeql.yml --branch remediation/test-target
# All should show at least 1 run for the pull_request event

Risk

MEDIUM. CI minutes cost increase. Mitigation: only modify pull_request blocks, not push.

Rollback

git checkout -- .github/workflows/*.yml
# or revert the commit

Effort

~45 min (10-12 files, all same mechanical change — parallelizable)

Provenance

Adversarial 4-member hyperplan, 3 rounds. Phase 2 of umbrella.