Add Studio CI workflows

.github/workflows/nb-studio-nocohr-preview.yml

@@ -0,0 +1,49 @@
+# Managed by NocoBase Studio (https://studio.v2.test.nocobase.com/main): deploys nocohr on the pull requests that touch it: builds the head and deploys it to the pull request's own App in preview.
+# Studio keeps the repository secret NB_STUDIO_API_KEY (an organization API key for this repository's CI) and rotates it.
+name: NocoBase Studio nocohr preview
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+permissions:
+  contents: read
+env:
+  NB_STUDIO_URL: 'https://studio.v2.test.nocobase.com/main'
+jobs:
+  deploy:
+    name: Deploy nocohr to preview
+    runs-on: ubuntu-latest
+    concurrency:
+      group: nb-studio-nocohr-preview-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    env:
+      APP_ID: 'nocohr-pr-${{ github.event.pull_request.number }}'
+      ENVIRONMENT: 'preview'
+      LOGS: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Install the nb-studio CLI
+        env:
+          NB_STUDIO_API_KEY: ${{ secrets.NB_STUDIO_API_KEY }}
+        run: |
+          eval "$(curl -fsS -H "x-api-key: $NB_STUDIO_API_KEY" "$NB_STUDIO_URL/api/agents/dist/products/nb-studio/targets/linux-x64?format=env")"
+          mkdir -p "$RUNNER_TEMP/nb-studio"
+          curl -fsS -H "x-api-key: $NB_STUDIO_API_KEY" "$NB_STUDIO_URL$url" | tar -xz --strip-components=1 -C "$RUNNER_TEMP/nb-studio"
+          echo "$RUNNER_TEMP/nb-studio/bin" >> "$GITHUB_PATH"
+          printf %s "$NB_STUDIO_API_KEY" | NB_STUDIO_KEYCHAIN=off "$RUNNER_TEMP/nb-studio/bin/nb-studio" login --server "$NB_STUDIO_URL" --api-key-stdin
+      - run: nb-studio build status --app "$APP_ID" --state building --logs "$LOGS"
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      # Leaves storage/exports/dist.tar.gz: dist/ and config.example.yml.
+      - run: pnpm build --target linux-x64 --tar
+      # The pull request's own App: Studio records the pull request as its source and removes it once it goes.
+      - run: nb-studio app ensure "$APP_ID" --environment "$ENVIRONMENT"
+      # Uploads the archive and deploys it; a protected environment asks its approvers instead.
+      - run: nb-studio deploy --app "$APP_ID" --file storage/exports/dist.tar.gz
+      - if: failure()
+        run: nb-studio build status --app "$APP_ID" --state failed --logs "$LOGS"