Build and test only what changed in GitHub Actions

# The job needs `permissions: { contents: read, actions: read }`
# (plus `pull-requests: read` if you run a merge queue): nx-set-shas calls the
# Actions API to find the last successful run, and a permissions block sets every
# scope you don't list to none.
- uses: actions/checkout@v7
  with:
    fetch-depth: 0                     # full history so the base commit is reachable
- uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1
  id: shas
- run: pnpm install --frozen-lockfile
- run: |
    # THE fail-safe, and it has to key off noPreviousBuild - NOT off an empty
    # NX_BASE. nx-set-shas never leaves NX_BASE empty: when it cannot find a
    # successful run to diff against it warns, silently falls back to HEAD~1,
    # and carries on. nx affected then scopes to a single commit and the check
    # goes green having tested a subset of a multi-commit PR. noPreviousBuild is
    # the only signal that says so, so branch on it and run everything.
    if [ "${{ steps.shas.outputs.noPreviousBuild }}" = "true" ]; then
      npx nx run-many -t build test
    else
      npx nx affected -t build test --base=$NX_BASE --head=$NX_HEAD
    fi

      - name: Set SHAs
        uses: nrwl/nx-set-shas@310288c04d90696f9f1bc27c5e3caea6642b53d4 # v5.0.0
# ...
          pnpm nx affected --targets=lint,test,build,e2e,e2e-ci,format-native,lint-native,gradle:build-ci,vale,run &

      - name: Tests (PR)
        if: ${{ github.event_name != 'push' }}
        run: pnpm exec turbo run test --filter="...[origin/${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || 'main' }}]" --concurrency=4

          fetch-depth: 0
      - uses: moonrepo/setup-toolchain@v0.6.2
        with:
          auto-install: true
      - run: pnpm install --frozen-lockfile
      - run: moon ci 2>&1 | tee moon-ci.log; exit ${PIPESTATUS[0]}