ci: cancel superseded PR runs and smoke linux-x64 only on a pull request

[tps-anvil]

No issue: CI load cut, measured 2026-10-14.

What changed

• .github/workflows/test.yml and .github/workflows/smoke.yml — the two
  pull_request workflows — get a workflow-level concurrency group:

  concurrency:
    group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.run_id }}
    cancel-in-progress: ${{ github.event_name == 'pull_request' }}

  A newer push to the same PR cancels the in-progress run; a push to main gets a
  group unique per run (run_id), so its runs are never cancelled.

• .github/workflows/smoke.yml — the compiled-binary smoke matrix is
  linux-x64 only on pull_request; push to main keeps the full
  linux-arm64 / darwin-x64 / darwin-arm64 matrix.

docker.yml (trigger workflow_dispatch) and release.yml (trigger tag push)
do not run on a pull request, so they are unchanged.

Evidence

actionlint 1.7.7 over .github/workflows/ — clean, exit 0.

Job instances per PR push, measured on 4c58c19 (main e883a2d):

workflow	jobs before	jobs after
test.yml	15	15
smoke.yml	4	1
total	19	16

test.yml's 13 jobs (15 instances once its two 2-target matrices expand) are
unchanged. The smoke.yml change is the four-target smoke matrix collapsing
to linux-x64 on a PR push. With cancel-in-progress on PR events, an earlier
push's whole run is cancelled when a newer push arrives, so a PR pushed N times
now costs one run instead of N.

Required checks on a PR

Ruleset main (id 13234034), required status checks. Every context still
reports on a pull request; none comes from smoke.yml.

required check	source on a PR
Build (TypeScript strict)	test.yml job build
Unit & Integration Tests	test.yml job test
Lint (Biome)	test.yml job lint
Semgrep SAST	test.yml job sast-semgrep
CodeQL SAST	test.yml job sast-codeql
Dependency Audit	test.yml job audit
Socket Security: Pull Request Alerts	Socket integration (156372) via socketdev/action in test.yml

Verification run on 4c58c19

• node scripts/test-suite.mjs cli packages/cli/test/workflow-permissions.test.ts packages/cli/test/release-workflow-permissions.test.ts — 18 pass, 0 fail. Baseline on unmodified main (workflow-permissions.test.ts): 11 pass, 0 fail. No regression.
• node scripts/changelog-fragments.mjs check — green; includes the new changed-ci-pr-run-load.md.
• bun run lint:ci — exit 0.
• bun install --frozen-lockfile && bun run build — exit 0.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 907f15ce-a091-4c7a-a19c-d92d00f1d5be

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tps-anvil]

Sweep — every sentence this PR adds or changes

Measured on 4c58c19 (main e883a2d). Claim types checked against the code:
(a) outcomes/status on each branch, (b) scope words, (c) coverage.

Grep for guarantee words over the diff and the PR body returned exactly these
sentences; each is listed below.

Workflow comments

1. test.yml, smoke.yml: "A superseded PR head's runs are cancelled (the group is the PR number); a push to main keeps a group unique per run, so its runs are never cancelled."

   • (a) on pull_request: cancel-in-progress: true, group = PR number → a newer push cancels the in-progress run. On non-PR: group = run_id (unique), cancel-in-progress: false → not cancelled. True.
   • (b) "never": true within this concurrency block; neither workflow has another concurrency key.
   • (c) config, not code; no unit test asserts it. actionlint 1.7.7 validates the expression. Keep.

2. smoke.yml: "On a pull request only linux-x64 is smoked; push to main keeps the full matrix."

   • (a) include on pull_request = one object (linux-x64); otherwise four. True.
   • (b) "only": true (one entry on PR). "full matrix": true (four entries on push). Keep.

3. smoke.yml macOS note (pre-existing wording, moved above include): "GitHub retired Intel mac runners (macos-13 queues forever). This job runs on Apple Silicon under Rosetta 2 translation — bun-compiled x64 binaries auto-translate. Bare-metal Intel mac is untested and that is a documented gap, not a hidden one."

   • Not a new claim: carried verbatim from origin/main, reflowed only. Keep.

.changelog/unreleased/changed-ci-pr-run-load.md

4. Lede: "Superseded pull-request runs are cancelled and the compiled-binary smoke runs linux-x64 only on a pull request." — both clauses true (items 1, 2); "only" true on a PR. Keep.
5. Body: "A push to main keeps the full OS/arch matrix." — true (four-entry include on push). Keep.

PR body

6. "A newer push to the same PR cancels the in-progress run; a push to main gets a group unique per run (run_id), so its runs are never cancelled." — matches item 1. Keep.
7. "the compiled-binary smoke matrix is linux-x64 only on pull_request; push to main keeps the full linux-arm64 / darwin-x64 / darwin-arm64 matrix." — matches item 2. Keep.
8. "docker.yml … and release.yml … do not run on a pull request." — docker.yml on: workflow_dispatch; release.yml on: push: tags:. True. Keep.
9. "Every context still reports on a pull request; none comes from smoke.yml." — the ruleset's seven contexts map to test.yml jobs plus the Socket integration; smoke.yml reports Smoke <target>, which is not required. True. Keep.
10. Job-count table (19 → 16) and test counts (18 pass / 0 fail; baseline 11 pass / 0 fail) — measured this turn. Keep.

Nothing left over-broad; no sentence deleted.