improvement(ci): affected-only build, typecheck, and unit tests on PRs

On pull requests, Turbo now scopes build, typecheck, and test tasks to
only packages that changed relative to the base branch — plus their
transitive dependents. On pushes to main/develop, the full suite runs.

Implementation details:
- Fetch the base branch at depth=1 before running Turbo so git can
  compute the diff (shallow clone cannot reach origin/main otherwise)
- Use --filter=[origin/<base_ref>]... to scope to affected packages
- Add --filter='!./apps/*' to exclude apps from the package build steps:
  Turbo's multiple --filter flags use union semantics, so without the
  negation, apps are included as dependents of changed packages and
  fail because generated files don't exist at that point in the job
- generate and build:app always run fully — generate is global module
  discovery; build:app is required for integration tests downstream

Expected impact on a PR touching 1 module:
  build:packages  2m30s → ~5s  (17 cache hits + 1 rebuild)
  typecheck       2m04s → ~5s  (only affected packages)
  unit tests      1m17s → ~5s  (only affected packages)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: yokoszn

.github/workflows/ci.yml

@@ -29,6 +29,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Fetch base branch for change detection
+        # Only needed on PRs — gives Turbo enough history to compute
+        # which packages changed relative to the target branch.
+        if: github.event_name == 'pull_request'
+        run: git fetch origin ${{ github.base_ref }} --depth=1
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
@@ -51,16 +57,37 @@ jobs:
         run: yarn install --immutable
 
       - name: Build packages
-        run: yarn build:packages
+        # On PRs: turbo run build scoped to affected packages only, apps excluded.
+        # Multiple --filter flags use union semantics, so we must exclude apps
+        # explicitly — they would otherwise be included as dependents of changed
+        # packages, and they fail here because generated files don't exist yet.
+        # On pushes to protected branches: full build, no filter.
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            yarn turbo run build \
+              --filter=[origin/${{ github.base_ref }}]... \
+              --filter='!./apps/*'
+          else
+            yarn build:packages
+          fi
         env:
           TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
           TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 
       - name: Prepare generated modules
+        # Always run fully — generator discovers all modules regardless of
+        # what changed, and its output is consumed by the app, not packages.
         run: yarn generate
 
       - name: Rebuild packages with generated files
-        run: yarn build:packages
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            yarn turbo run build \
+              --filter=[origin/${{ github.base_ref }}]... \
+              --filter='!./apps/*'
+          else
+            yarn build:packages
+          fi
         env:
           TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
           TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
@@ -108,6 +135,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Fetch base branch for change detection
+        if: github.event_name == 'pull_request'
+        run: git fetch origin ${{ github.base_ref }} --depth=1
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
@@ -155,15 +186,30 @@ jobs:
         continue-on-error: true
 
       - name: Checking types
-        run: yarn typecheck
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            yarn turbo run typecheck \
+              --filter=[origin/${{ github.base_ref }}]... \
+              --filter='!./apps/*'
+          else
+            yarn typecheck
+          fi
         env:
           TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
           TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
 
       - name: Test
-        run: yarn test
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            yarn turbo run test \
+              --filter=[origin/${{ github.base_ref }}]... \
+              --filter='!./apps/*'
+          else
+            yarn test
+          fi
 
       - name: Build
+        # Always build the full app — integration tests need a complete build.
         run: yarn build:app
 
   # ── Integration tests ───────────────────────────────────────────────────────