ci(security): materialize stacked-PR validation on trusted branch

.github/workflows/security.yml

@@ -8,7 +8,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
   schedule:
     - cron: "17 3 * * 1"
     - cron: "41 4 * * 2"
@@ -18,13 +18,15 @@ permissions:
   contents: read
 
 concurrency:
-  group: local-quality-${{ github.repository }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.event.schedule || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.event.schedule || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   tests:
     name: Tests and package quality
-    if: github.event_name != 'schedule'
+    if: >-
+      github.event_name != 'schedule' &&
+      (github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false))
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -81,7 +83,9 @@ jobs:
 
   fuzz:
     name: Property and coverage-guided fuzzing
-    if: github.event_name != 'schedule' || github.event.schedule == '41 4 * * 2'
+    if: >-
+      (github.event_name != 'schedule' || github.event.schedule == '41 4 * * 2') &&
+      (github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false))
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -134,7 +138,10 @@ jobs:
     name: CodeQL, supply chain, and SBOM
     if: >-
       (github.event_name != 'schedule' || github.event.schedule == '17 3 * * 1') &&
-      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+      (github.event_name != 'pull_request' ||
+        (github.event.action != 'closed' &&
+         github.event.pull_request.draft == false &&
+         github.event.pull_request.head.repo.full_name == github.repository))
     runs-on: ubuntu-latest
     permissions:
       actions: read

tests/test_repository_security_metadata.py

@@ -68,9 +68,15 @@ def test_security_workflow_covers_core_repository_security_process():
     for duplicate_scanner in removed_duplicate_scanners:
         assert duplicate_scanner not in workflow_text
 
-    assert "local-quality-${{ github.repository }}-${{ github.event_name }}-${{" in workflow_text
-    assert "github.event.pull_request.number || github.event.schedule || github.ref" in workflow_text
-    assert "cancel-in-progress: true" in workflow_text
+    assert "${{ github.workflow }}-${{ github.repository }}-${{" in workflow_text
+    assert "github.event.pull_request.number || github.event.schedule || github.run_id" in workflow_text
+    assert "cancel-in-progress: ${{ github.event_name == 'pull_request' }}" in workflow_text
+    assert (
+        "types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]"
+        in workflow_text
+    )
+    assert workflow_text.count("github.event.pull_request.draft == false") == 3
+    assert workflow_text.count("github.event.action != 'closed'") == 3
 
     assert not (ROOT_DIR / ".github/workflows/ci.yml").exists()
     assert not (ROOT_DIR / ".github/workflows/fuzz.yml").exists()
@@ -81,6 +87,15 @@ def test_security_workflow_covers_core_repository_security_process():
     assert all(re.search(r"@[0-9a-f]{40}(?:\s+#|$)", line) for line in uses_lines)
 
 
+def test_security_workflow_supports_stacked_pull_requests():
+    workflow_text = read_text(".github/workflows/security.yml")
+    pull_request_trigger = workflow_text.split("  pull_request:\n", 1)[1].split(
+        "  schedule:\n", 1
+    )[0]
+
+    assert "branches:" not in pull_request_trigger
+
+
 def test_dependabot_tracks_actions_and_python_dependencies():
     dependabot_text = read_text(".github/dependabot.yml")