ci(governance): make PR evaluation cancellation trigger-aware

[seonghobae]

Problem

PR Governance publishes one shared check identity and one idempotent blocker
comment per PR. Workflow-level groups correctly let a newer synchronize event
cancel an older synchronize evaluation, but review, check, workflow, manual, and
synchronize events could still run concurrently. Two same-head snapshots could
therefore publish out of order and let stale evidence overwrite newer state.

Repair

• keep only pull_request_target/synchronize runs in the cancellable workflow group;
• keep every other workflow run independent so events do not cancel one another;
• route every event for one PR through a shared governance-job publisher group;
• set publisher cancel-in-progress: false so one running evaluation finishes before the latest pending evaluation publishes;
• keep different PRs isolated;
• retain the local trusted-base evaluator for non-default bases until central required workflows cover them.

This metadata publisher deliberately uses the default single-pending queue: an older pending evaluation may be replaced, while the admitted job reads current evidence before publishing. This is coalesced state evaluation, not lossless event delivery. GitHub now supports queue: max with non-cancelling groups (up to100 pending); its omission here must not be described as platform non-support. The workflow remains metadata-only and never checks out PR-head code.

Do not copy this pending-replacement policy into release, deployment or migration delivery. Those paths need retained/recoverable intent, shared-target locking and exact-revision/idempotency evidence; see GA release-ordering gap. This PR does not implement that release contract.

Reference: GitHub. (n.d.). Control the concurrency of workflows and jobs. https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency (accessed2026-09-06).

Exact authority

• protected base: develop@042b0c70531b229af3acbd0421a2f23098d848b3
• exact head: 4d84882bc6864ab2ba63d068e1b2252a93dfc57a
• lifecycle: Draft / source race repaired / hosted evidence incomplete

Verification

• PR-governance concurrency and release-governance tests: 38 passed with warnings as errors
• governance gate shell harness: passed
• actionlint: passed
• diff check: passed

Keep Draft until the unchanged head has terminal-success required checks, zero
valid unresolved findings, and qualifying current-head review evidence. No
predecessor evidence, force push, self-approval, dismissal, bypass, or dummy
requeue commit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 7e786c0a-9e8b-4620-a467-08e3912a10dc

📥 Commits

Reviewing files that changed from the base of the PR and between 042b0c7 and 3d29ce2.

📒 Files selected for processing (1)

• .github/workflows/pr-governance.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Important

Approval pending

CodeRabbit has no unresolved comments, but it has not reviewed the latest commit.

Use the checkbox below to review the latest commit. CodeRabbit will approve the changes if it finds no blocking issues.

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The pull request governance workflow now uses event-specific concurrency groups. New pull_request_target synchronize events cancel older synchronize evaluations. Other event types remain in separate, non-cancellable groups.

Changes

PR governance concurrency

Layer / File(s)	Summary
Event-specific concurrency policy .github/workflows/pr-governance.yml	The concurrency group now includes synchronize for pull_request_target synchronize events and the event name for other events. Cancellation is enabled only for synchronize events.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 3d29c

The workflow now cancels superseded governance runs only for new commits on the same pull request while preserving other event behavior; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: trigger-aware cancellation for PR evaluation governance.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/pr-governance-cancel-stale-head

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR governance metadata gate is not ready for 2ea09b5cab6e8efe579d9a6952f01a49d0a14b30:

• Draft PR: merge automation is paused.
• Required check trivy-fs is CANCELLED on the current head.
• Required check osv-scan is CANCELLED on the current head.
• Required check dependency-review is CANCELLED on the current head.
• Required check scorecard is CANCELLED on the current head.
• Required check strix is CANCELLED on the current head.
• Required check dependency-review is CANCELLED on the current head.
• Required check backend (Python 3.14) is CANCELLED on the current head.
• Required check frontend is CANCELLED on the current head.
• Required check validate frontend image is CANCELLED on the current head.
• Required check validate naruon image is CANCELLED on the current head.
• Required check validate backend image is CANCELLED on the current head.
• Required check security is CANCELLED on the current head.

[seonghobae]

Current-head repair finding: backend/tests/test_release_governance.py::test_pr_governance_concurrency_serializes_non_sync_events_and_cancels_only_sync asserts the literal substring && 'synchronize' && 'synchronize' || 'other', but .github/workflows/pr-governance.yml contains only && 'synchronize' || 'other' after the action predicate. This is a deterministic source-level RED on exact head 80575af7b35cb0f629952e0c5033cbb1c8d63914; the test can fail even though the intended workflow expression is present. The PR has been returned to Draft. Minimum causal repair is to correct the assertion to the actual expression (without weakening the event/group/cancellation assertions), then regenerate exact-head CI/review evidence. Predecessor checks/reviews do not transfer.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T14:14:54.882268Z	20ca2ca	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seonghobae]

Repair finding: this deletion is not yet a complete successor for #1531. The live central scheduler at protected .github@main validates current-head OpenCode approval identity, but its merge decision path does not yet enforce the repository-local fallback contract that requires a structured adversarial body naming the head SHA with at least two falsified probes. Deleting pr_governance_gate.sh now would discard that valid delta instead of transferring it. Keep this PR Draft until the canonical .github owner publishes and tests the equivalent contract, then pin that exact owner revision here and rerun the 34 governance tests plus hosted current-head gates. #1531 remains the non-force repair lane meanwhile.

[seonghobae]

이전에 기록한 중앙 승계 전제조건을 current source 기준으로 다시 확인했습니다. protected central main 769691526f8c73cf714de8fe8ba51ae6cfa2901a에서 OpenCode 게시 경로는 구조화 승인 검사를 거치며, 기존 승인 재사용 경로도 App 작성자·exact head·workflow run/attempt·status=passed·falsified probes·source evidence를 fail-closed로 검증합니다. 중앙 scheduler는 별도로 비작성자·비bot exact-current-head 독립 승인까지 요구합니다. focused 31개가 통과했습니다.

따라서 이 저장소에 동일한 로컬 gate parser를 중복 유지해야 한다는 당시 전제는 해소됐습니다. #1543 exact head 887d2461526d0f1c70748cf9c9f726a45b742b5e에서 제품 코드 변경 없이 34개 governance test, actionlint, diff-check가 통과했고 unresolved thread는 0입니다. Draft를 해제하고 auto-merge를 복구했습니다. 아직 queued인 exact-head checks와 독립 승인은 계속 merge gate로 남습니다.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 887d246152

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 20ca2ca94d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".