Replace Percy with nitpix for visual testing

.github/workflows/nitpix-approve.yml

@@ -0,0 +1,25 @@
+name: nitpix approve
+
+# Handles `/nitpix approve` comments on PRs: records the approved snapshot
+# hashes on the nitpix-baselines branch and flips the `nitpix/visual` commit
+# status to success — without re-running the test matrix. Only users with
+# write access can approve.
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  approve:
+    name: Approve visual changes
+    runs-on: ubuntu-latest
+    if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/nitpix')
+    steps:
+      - uses: plotly/nitpix/approve@ab5cf6a797cd5d5d12821b1339cf429f7063edc3 # 2026-07-08, TODO: move to @v1 once released
+        with:
+          baseline-branch: nitpix-baselines

.github/workflows/nitpix.yml

@@ -0,0 +1,44 @@
+name: nitpix
+
+# Visual diffing (replaces Percy). Runs in the base-repo context via
+# workflow_run so it has a full-privilege token even for fork and Dependabot
+# PRs (which get a read-only token in "Dash Testing" itself).
+#
+# - PR-triggered test runs: diff the uploaded nitpix-snapshots-* artifacts
+#   against baselines/<base-branch>/ on the nitpix-baselines orphan branch,
+#   post/update the review comment and the `nitpix/visual` commit status.
+#   Approve visual changes by commenting `/nitpix approve` on the PR
+#   (see nitpix-approve.yml).
+# - push-triggered test runs (dev/master): promote that run's snapshots to
+#   the branch's baselines.
+#
+# SECURITY: never check out or execute PR code in this workflow — it runs
+# with write permissions for all PRs. nitpix only handles PNG artifacts.
+
+on:
+  workflow_run:
+    workflows: ["Dash Testing"]
+    types: [completed]
+
+permissions:
+  actions: read          # download the nitpix-snapshots-* artifacts from the test run
+  contents: write        # push to the nitpix-baselines branch
+  pull-requests: write   # the review comment
+  statuses: write        # the nitpix/visual check
+
+concurrency:
+  group: nitpix-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  visual-review:
+    name: Visual Review
+    runs-on: ubuntu-latest
+    if: |
+      github.event.workflow_run.conclusion == 'success' &&
+      (github.event.workflow_run.event == 'pull_request' ||
+       github.event.workflow_run.event == 'push')
+    steps:
+      - uses: plotly/nitpix@ab5cf6a797cd5d5d12821b1339cf429f7063edc3 # 2026-07-08, TODO: move to @v1 once released
+        with:
+          baseline-branch: nitpix-baselines

.github/workflows/post-test-status.yml

@@ -65,43 +65,9 @@ jobs:
               }
             }
 
-      - name: Post Percy status for fork/Dependabot PRs
-        # Percy needs PERCY_TOKEN to run, which is unavailable to fork PRs (and to
-        # Dependabot unless added to Dependabot secrets). Without a build, the
-        # Percy GitHub App never posts the required `percy/dash` status and the PR
-        # is blocked. Post a success status here so the check resolves — but only
-        # if Percy hasn't already posted one, so a real Percy result is never
-        # clobbered (e.g. when Dependabot does have the token).
-        if: >
-          github.event.workflow_run.head_repository.full_name != github.repository ||
-          github.event.workflow_run.actor.login == 'dependabot[bot]'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const sha = context.payload.workflow_run.head_sha;
-            const statusContext = 'percy/dash';
-
-            const { data: { statuses } } = await github.rest.repos.getCombinedStatus({
-              owner,
-              repo,
-              ref: sha,
-            });
-
-            if (statuses.some(s => s.context === statusContext)) {
-              console.log(`'${statusContext}' already posted — leaving it untouched.`);
-              return;
-            }
-
-            await github.rest.repos.createCommitStatus({
-              owner,
-              repo,
-              sha,
-              state: 'success',
-              context: statusContext,
-              description: 'Skipped — Percy unavailable for fork/Dependabot PRs',
-            });
-            console.log(`Posted skipped status for ${statusContext}`);
+      # NOTE: the "Post Percy status for fork/Dependabot PRs" workaround that
+      # lived here was removed with the move to nitpix (nitpix.yml), which
+      # handles fork/Dependabot PRs natively via workflow_run.
 
   test-report:
     name: Consolidated Test Report (Fork PR)