Tweaks to CI (#33014)

* Tweak github actions to make Sonar & zizmor happier

* Apply filters on some pnpm install calls

* Remove stale setup-python step

* Add missing needs in complete job

* Remove repository_dispatch for everything bar develop CD

js-sdk now runs the tests downstream so this was unnecessary

* Fix prepare desktop for tests in merge queue

* Iterate

* Iterate

* Iterate

* Discard changes to .github/workflows/build_desktop_linux.yaml

* Discard changes to .github/workflows/build_desktop_macos.yaml

.github/actions/download-verify-element-tarball/action.yml

@@ -31,7 +31,9 @@ runs:
 
         - name: Move webapp to out-file-path
           shell: bash
-          run: mv ${{ runner.temp }}/download-verify-element-tarball/webapp ${{ inputs.out-file-path }}
+          run: mv ${{ runner.temp }}/download-verify-element-tarball/webapp "$OUT_PATH"
+          env:
+              OUT_PATH: ${{ inputs.out-file-path }}
 
         - name: Clean up temp directory
           shell: bash

.github/workflows/build-and-test.yaml

@@ -18,8 +18,6 @@ on:
     push:
         # We do not build on push to develop as the merge_group check handles that
         branches: [staging, master]
-    repository_dispatch:
-        types: [element-web-notify]
 
     # support triggering from other workflows
     workflow_call:
@@ -246,6 +244,7 @@ jobs:
         needs:
             - playwright_ew
             - downstream-modules
+            - prepare_ed
             - build_ed_windows
             - build_ed_linux
             - build_ed_macos

.github/workflows/shared-component-visual-tests-netlify.yaml

@@ -2,7 +2,9 @@
 # It uploads the received images and diffs to netlify, printing the URLs to the console
 name: Upload Shared Component Visual Test Diffs
 on:
-    workflow_run:
+    # Privilege escalation necessary to deploy to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
         workflows: ["Shared Component Visual Tests"]
         types:
             - completed

.github/workflows/sonarqube.yml

@@ -1,6 +1,8 @@
 name: SonarQube
 on:
-    workflow_run:
+    # Privilege escalation necessary to call upon SonarCloud
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
         workflows: ["Tests"]
         types:
             - completed

.github/workflows/static_analysis.yaml

@@ -5,8 +5,6 @@ on:
         branches: [develop, master]
     merge_group:
         types: [checks_requested]
-    repository_dispatch:
-        types: [element-web-notify]
 concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
     cancel-in-progress: true

.github/workflows/tests.yml

@@ -5,8 +5,6 @@ on:
         types: [checks_requested]
     push:
         branches: [develop, master]
-    repository_dispatch:
-        types: [element-web-notify]
     workflow_call:
         inputs:
             disable_coverage: