ci(governance): make PR evaluation cancellation trigger-aware

.github/workflows/pr-governance.yml

@@ -31,8 +31,12 @@ permissions:
   issues: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.workflow_run.pull_requests[0].number || github.event.check_run.pull_requests[0].number || github.event.inputs.pr_number || github.run_id }}
-  cancel-in-progress: false
+  # Synchronize events get their own PR-scoped group, so a newer push cancels
+  # only an older synchronize evaluation. All other events share a second
+  # PR-scoped group, preserving their serialized, non-cancelling behavior.
+  group: >-
+    ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.workflow_run.pull_requests[0].number || github.event.check_run.pull_requests[0].number || github.event.inputs.pr_number || github.run_id }}-${{ github.event_name == 'pull_request_target' && github.event.action == 'synchronize' && 'synchronize' || 'other' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request_target' && github.event.action == 'synchronize' }}
 
 jobs:
   governance:

backend/tests/test_release_governance.py

@@ -1203,3 +1203,46 @@ def test_agents_records_ghcr_visibility_publication_runbook() -> None:
     assert "Danger Zone" in agents
     assert "Change visibility" in normalized_agents
     assert "anonymous pull/token access" in agents
+
+
+def test_pr_governance_concurrency_serializes_non_sync_events_and_cancels_only_sync() -> None:
+    """The workflow prevents stale cross-trigger writes without cancelling recovery work."""
+    workflow = read_repo_text(".github/workflows/pr-governance.yml")
+    assert "github.event_name == 'pull_request_target'" in workflow
+    assert "github.event.action == 'synchronize'" in workflow
+    assert "&& 'synchronize' && 'synchronize' || 'other'" in workflow
+    assert (
+        "cancel-in-progress: ${{ github.event_name == 'pull_request_target' "
+        "&& github.event.action == 'synchronize' }}"
+    ) in workflow
+    assert "|| github.event_name }}" not in workflow
+
+    def expected_group(pr_number: int, event_name: str, action: str = "") -> str:
+        """Model the two suffixes used by the workflow expression."""
+        suffix = (
+            "synchronize"
+            if event_name == "pull_request_target" and action == "synchronize"
+            else "other"
+        )
+        return f"pr-governance-{pr_number}-{suffix}"
+
+    assert expected_group(42, "pull_request_target", "synchronize") != expected_group(
+        42, "pull_request_review", "submitted"
+    )
+    assert expected_group(42, "pull_request_review", "submitted") == expected_group(
+        42, "workflow_run"
+    )
+    assert expected_group(42, "check_run") == expected_group(42, "workflow_dispatch")
+    assert expected_group(
+        42, "pull_request_target", "synchronize"
+    ) != expected_group(43, "pull_request_target", "synchronize")
+
+    def expected_cancel(event_name: str, action: str = "") -> bool:
+        """Model the workflow's cancellation predicate."""
+        return event_name == "pull_request_target" and action == "synchronize"
+
+    assert expected_cancel("pull_request_target", "synchronize") is True
+    assert expected_cancel("pull_request_review", "submitted") is False
+    assert expected_cancel("workflow_run") is False
+    assert expected_cancel("check_run") is False
+    assert expected_cancel("workflow_dispatch") is False