ci: validate stacked pull request bases

.github/workflows/app-ci.yml

@@ -11,7 +11,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: application-ci-${{ github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -87,7 +87,9 @@ jobs:
           persist-credentials: false
 
       - name: Install pnpm
-        run: corepack enable pnpm
+        run: |
+          corepack enable pnpm
+          corepack install --global pnpm@11.5.3
 
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/bandit.yml

@@ -9,6 +9,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.run_attempt == 1 }}
+
 jobs:
   security:
     runs-on: ubuntu-latest

.github/workflows/docker-publish.yml

@@ -9,6 +9,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
   REGISTRY: ghcr.io
   # Keep the explicit opt-in as belt-and-suspenders. The real warning removal

backend/tests/test_release_governance.py

@@ -673,6 +673,35 @@ def test_app_ci_runs_backend_and_frontend_checks_without_duplicate_release_pushe
     assert "branches-ignore:" not in pull_request_block
 
 
+@pytest.mark.parametrize(
+    "workflow_path",
+    [
+        ".github/workflows/app-ci.yml",
+        ".github/workflows/bandit.yml",
+        ".github/workflows/docker-publish.yml",
+    ],
+)
+def test_pr_validation_workflows_run_for_stacked_base_branches(
+    workflow_path: str,
+) -> None:
+    workflow_text = read_repo_text(workflow_path)
+    workflow = yaml.load(workflow_text, Loader=yaml.BaseLoader)
+
+    assert workflow["on"]["pull_request"] in (None, "")
+    assert (
+        "group: ${{ github.workflow }}-${{ github.repository }}-"
+        "${{ github.event.pull_request.number || github.ref }}"
+    ) in workflow_text
+
+
+def test_merge_gate_policy_documents_stacked_base_validation() -> None:
+    policy = read_repo_text("docs/development/merge-gate-policy.md")
+
+    assert "run on every pull\n  request base, including stacked branches" in policy
+    assert "direct push checks for `develop` and `master`" in policy
+    assert "tag publication is never cancelled" in policy
+
+
 def test_docker_publish_validates_pr_images_and_publishes_semver_images_only_on_tags() -> (
     None
 ):
@@ -681,6 +710,7 @@ def test_docker_publish_validates_pr_images_and_publishes_semver_images_only_on_
     assert "pull_request:" in workflow
     assert "push:" in workflow
     assert "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true" in workflow
+    assert "cancel-in-progress: ${{ github.event_name == 'pull_request' }}" in workflow
     assert (
         workflow.count(
             "docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0"
@@ -750,8 +780,13 @@ def test_frontend_dockerfile_builds_and_starts_production_artifact() -> None:
     docker_publish_workflow = read_repo_text(".github/workflows/docker-publish.yml")
     frontend_deployment = read_repo_text("k8s/frontend-deployment.yaml")
     package_json = read_repo_text("frontend/package.json")
+    app_ci_workflow = read_repo_text(".github/workflows/app-ci.yml")
 
     assert '"packageManager": "pnpm@11.5.3"' in package_json
+    assert "corepack install --global pnpm@11.5.3" in app_ci_workflow
+    assert app_ci_workflow.index("corepack install --global pnpm@11.5.3") < (
+        app_ci_workflow.index("cache: pnpm")
+    )
     assert "NEXT_PUBLIC_API_URL" not in root_dockerfile
     assert "NEXT_PUBLIC_API_URL" not in dockerfile
     assert "NEXT_PUBLIC_API_URL" not in docker_publish_workflow

backend/tests/test_workflow_concurrency.py

@@ -0,0 +1,31 @@
+"""Regression tests for GitHub Actions concurrency boundaries."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+
+
+def _load_workflow(workflow_name: str) -> dict[str, object]:
+    path = REPO_ROOT / ".github" / "workflows" / workflow_name
+    assert path.exists(), f"workflow is missing: {workflow_name}"
+    parsed = yaml.safe_load(path.read_text(encoding="utf-8"))
+    assert isinstance(parsed, dict), (
+        f"workflow must parse as a mapping: {workflow_name}"
+    )
+    return parsed
+
+
+def test_bandit_cancels_only_superseded_pull_request_runs() -> None:
+    """Keep manual, push, and rerun scans independent while deduplicating first PR scans."""
+    concurrency = _load_workflow("bandit.yml").get("concurrency")
+
+    assert isinstance(concurrency, dict)
+    assert concurrency == {
+        "group": "${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}",
+        "cancel-in-progress": "${{ github.event_name == 'pull_request' && github.run_attempt == 1 }}",
+    }

docs/development/merge-gate-policy.md

@@ -8,10 +8,11 @@ awaited by default.
 ## Required gate contract
 
 - Required status checks must pass on the current head SHA.
-- Application CI must run backend pytest and frontend test/lint/build checks on
-  every pull request, including one stacked on another open PR's branch, not
-  just `develop`/`master`/`release/**` — required checks must not exclude a PR
-  base; push checks are scoped to `develop` and `master`.
+- Application CI, Bandit, and pull-request image validation run on every pull
+  request base, including stacked branches. Application CI and Bandit retain
+  direct push checks for `develop` and `master`; image publication remains
+  tag-only for `v*`. Validation concurrency is scoped by workflow, repository,
+  and PR, while tag publication is never cancelled by a newer run.
 - The robot-review gate prefers CodeRabbit evidence. When the current head has
   CodeRabbit check-run evidence, it satisfies the gate only when current-head
   blocking findings, warnings, and failures are fixed, rebutted with evidence,