ci: publish a PR opened with preview from its label run only

.github/workflows/ci.yml

@@ -157,15 +157,16 @@ jobs:
     name: Publish preview
     runs-on: ubuntu-latest
     needs: test
-    # Opened, synchronize and reopened runs publish on a feat/fix branch or with `preview`; a label run only when it
-    # adds `preview` to any other branch.
+    # A feat/fix branch publishes on opened, synchronize and reopened. Any other branch publishes from the label run
+    # that adds `preview` (a PR opened with it gets one too), then on synchronize and reopened while it has it.
     if: >-
-      ${{ (github.event.action == 'labeled'
+      ${{ (github.event.action != 'labeled'
+        && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix')))
+      || (github.event.action == 'labeled'
         && github.event.label.name == 'preview'
         && !startsWith(github.head_ref, 'feat') && !startsWith(github.head_ref, 'fix'))
-      || (github.event.action != 'labeled'
-        && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix')
-          || contains(github.event.pull_request.labels.*.name, 'preview'))) }}
+      || ((github.event.action == 'synchronize' || github.event.action == 'reopened')
+        && contains(github.event.pull_request.labels.*.name, 'preview')) }}
     # One publish to `pr-<number>` at a time: label runs don't share the workflow's group.
     concurrency:
       group: ${{ github.workflow }}-preview-${{ github.ref }}

docs/development.md

@@ -51,7 +51,7 @@ In the repo, `pnpm rr` and `pnpm vland`, or `rr` and `vland` with mise, run each
 
 ## CI
 
-- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools with [mise-action](https://github.com/jdx/mise-action), then runs `pnpm install --frozen-lockfile`, `pnpm rr check`, `pnpm test` and `pnpm build`, once on the Node floor in `mise.floor.toml` and once on the version in `mise.toml`. Beside them, gitleaks scans the pull request's commits for secrets. The required `Test` check passes when all three do. Adding a label runs CI again, and labels added at once don't cancel one another's runs. Of those runs, only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview. Workflow audit runs [zizmor](https://docs.zizmor.sh) on every workflow in the repo, including those the vland templates generate.
+- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools with [mise-action](https://github.com/jdx/mise-action), then runs `pnpm install --frozen-lockfile`, `pnpm rr check`, `pnpm test` and `pnpm build`, once on the Node floor in `mise.floor.toml` and once on the version in `mise.toml`. Beside them, gitleaks scans the pull request's commits for secrets. The required `Test` check passes when all three do. Adding a label runs CI again, and labels added at once don't cancel one another's runs. Of those runs, only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview, and a pull request opened on such a branch with `preview` publishes from its label run, not its `opened` run. Workflow audit runs [zizmor](https://docs.zizmor.sh) on every workflow in the repo, including those the vland templates generate.
 - **Git hooks** ([lefthook](https://lefthook.dev)): `lefthook.yml` extends the two configs that `@rrlab/cli` ships, `run-run/cli/lefthook/base.yml` and `run-run/cli/lefthook/turborepo.yml`, and its own `shared-hooks` job fails a commit, saying to run `pnpm install`, when they are missing from `node_modules`. Their jobs are listed in [the cli's README](../run-run/cli/README.md#git-hooks). `lefthook/turborepo.yml` is not dx's: it holds the hooks that other repos fetch remotely.
 - **Every Monday:** `pnpm audit` on the lockfile, which keeps an issue labeled `dependency-audit` open while it finds known vulnerabilities (Dependency audit).