ci: auto-run the hardware-lab release-QA on each firmware PR

[ericmigi]

What

After build-qa-firmware builds the dual-slot artifact, a new dispatch-release-qa job kicks off the hardware-lab release-QA in coredevices/unicorn against this run's qa-firmware-<board> — the full erase → PRF → pair → OTA → functional pass on a real phone + watch — and the unicorn run posts a unicorn/release-qa commit status back on the PR commit.

• coreapp APK: the most recently tagged coreapp release (unicorn resolves the newest tag → its Build Android run; nothing to pass).
• Internal PRs only (forks have no secrets). Per-PR concurrency so a newer push supersedes the older dispatch.

⚠️ Requires a secret

Needs UNICORN_DISPATCH_TOKEN in this repo's secrets — a PAT with actions:write on coredevices/unicorn (same pattern coreapp uses to trigger unicorn smoke). Without it the job no-ops with a warning, so this PR is safe to merge before the secret exists; the QA just won't fire until it's added.

⚠️ One rig, ~25 min/run

The lab has a single phone+watch and unicorn serializes runs (firmware-lab concurrency). Every internal firmware-PR push triggers a ~25 min run, so on a busy day these queue. If that's too much, we can gate it to a label (e.g. hw-qa) or ready-for-review instead of every push — easy follow-up.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 427a85a0a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep the cross-repository token out of PR-controlled workflows

Because this workflow runs on pull_request, a same-repository PR passes the repository check while its version of this YAML still controls the run step. Such a PR can replace the command with one that exfiltrates GH_TOKEN, gaining the token's cross-repository Actions write access to Unicorn; filtering out forks does not protect against compromised or malicious internal branches. Perform the secret-bearing dispatch from workflow code loaded from the trusted default branch, such as a carefully validated workflow_run workflow.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Enforce per-PR cancellation in the remote workflow

When two pushes reach this job far enough apart for the first dispatch command to finish—the normal case because each run first rebuilds firmware—there is no longer a local job for this concurrency group to cancel. gh workflow run only creates the remote workflow_dispatch event and returns, so the already-dispatched Unicorn run remains queued or running in the other repository and obsolete hardware-lab runs accumulate despite the stated one-in-flight behavior. Deduplication or cancellation needs to be enforced in Unicorn, or this job must explicitly cancel the prior remote run.

Useful? React with 👍 / 👎.

[ericmigi]

Added an org-member gate: dispatch-release-qa now also requires author_association ∈ {OWNER, MEMBER, COLLABORATOR}, so only org members / collaborators trigger the hardware lab — an outside contributor's PR won't (on top of the existing non-fork check).

[jplexer]

squash and fix compliance checks before merging, otherwise lgtm