ci: run lint + tests on PRs, not only on push to main

PR #14 merged with mergeStateStatus CLEAN and zero checks: static.yml
only triggered on push to main, so nothing ran against the PR branch
itself. The break it introduced (forecastLabel test fixtures crossing
a UTC midnight) was caught by the post-merge deploy job instead,
after landing on main.

Split into a test job (push + pull_request, no deploy secrets needed)
and a deploy job (needs: test, push-only) so a PR can't merge past a
red test run again. Pinned every action in the file to its commit SHA
while touching it, per repo convention.

Author: bgrozev

.github/workflows/static.yml

@@ -6,6 +6,10 @@ on:
   push:
     branches: ["main"]
 
+  # Also test-only on PRs targeting main, so a break is caught before merge
+  pull_request:
+    branches: ["main"]
+
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
@@ -22,36 +26,51 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  # Single deploy job since we're just deploying
+  # Lint + test: runs on every push and every PR against main.
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - name: Use Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+          cache: 'npm'
+      - run: npm install
+      - run: npm run lint
+      - run: npm test
+
+  # Build + deploy: only for pushes to main, and only once tests pass.
   deploy:
+    needs: test
+    if: github.event_name == 'push'
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
           cache: 'npm'
       - run: npm install
-      - run: npm run lint
-      - run: npm test
       - run: node scripts/inject-ga.js
         env:
           GA_ID: ${{ secrets.GA_ID }}
       - run: npm run build --if-present
         env:
           VITE_GOOGLE_MAPS_API_KEY: ${{ secrets.GOOGLE_MAPS_API_KEY }}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           # Upload entire repository
           path: 'build'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5