[rqbazan]

Summary

GitHub reads a required check from the latest run of its workflow on the head commit. Test (CI) and Audit workflows (Workflow audit) ran on labeled, in one group per ref with cancel-in-progress, so labels added at once could leave a run cancelled before any job as the latest, and the check never reported (seen on withvariablelab/dx#305). Neither workflow reads a label, so they stop running on one. Release keeps labeled for preview and takes withvariablelab/dx#306 fix.

 CI, Workflow audit:
-  on: pull_request [opened, synchronize, reopened, labeled]
+  on: pull_request                     # default: opened, synchronize, reopened

 Release:
   concurrency:
-    group: Release-<ref>
+    group: Release-<run_id> on a labeled run, else Release-<ref>
     cancel-in-progress: true

   Publish preview:
-    if: pull_request && (feat/fix branch || PR has `preview`)
+    if: pull_request && ((not labeled && feat/fix branch)
+                      || (labeled `preview` && branch is not feat/fix)
+                      || (synchronize/reopened && PR has `preview`))
+    concurrency: Release-preview-<ref>, queued, never cancelled

• A label starts no run of CI or Workflow audit, so their latest run on the head commit is the one of its last push (or opened/reopened), which no label run can cancel. There is no race to win, whatever order the label events arrive in.
• Unlike dx, CI and the audit don't give label runs a group of their own: they read no label, so a label would only buy a full rerun and a pending Test. The preview stays in release.yml, the workflow npm's trusted publisher names.
• A label run publishes only when it adds preview to a branch other than feat/fix. Before, any label added to a feat/fix PR, or to one with preview, republished the same commit, which fails: <version>-git-<sha7>.0 already exists.
• opened leaves preview to its own labeled run, so a PR created with preview publishes once, not from both. dx's condition lacks this guard.
• docs/development.md § CI says a label runs neither CI nor the audit.

Evidence

• Before: chore: regenerate CLI docs dx#305: the run created last (42058729129) was cancelled with no jobs, Test showed "Expected — Waiting for status to be reported" and the PR stayed BLOCKED until a manual rerun.
  After: gh pr edit --add-label dependencies --add-label javascript on this PR, twice (labels removed in between, which started no run), after the first checks finished on d105230. No rerun:

  Burst	Runs it started (created)	CI / Workflow audit runs	Test, Audit workflows	mergeStateStatus
  20:19:52Z	Release 42102383636, 42102384036 (both 20:19:58Z), completed, jobs skipped by their if	none	success, from the push's runs 42101255096 and 42101255052	CLEAN
  20:21:03Z	Release 42102573167, 42102574174 (both 20:21:10Z), completed, jobs skipped by their if	none	same	CLEAN

  Each burst's two Release runs were created in the same second and neither was cancelled: each had a group of its own.

• The preview if, parsed from release.yml and evaluated with GitHub's expression engine (@actions/expressions 0.3.61) over mock payloads:

  Event	Branch	Labels on the PR	Before	After
  push	main	—	no	no
  opened	feat/x	—	yes	yes
  opened	ci/x	—	no	no
  opened	ci/x	preview	yes, and its labeled run too	no: its labeled run publishes
  labeled preview	ci/x	preview	yes	yes
  synchronize	fix/x	—	yes	yes
  synchronize	ci/x	preview	yes	yes
  reopened	ci/x	preview	yes	yes
  labeled preview	feat/x	preview	yes, duplicate: fails	no: its pushes publish
  labeled dependencies	ci/x	preview, dependencies	yes, duplicate: fails	no
  labeled dependencies	feat/x	dependencies	yes, duplicate: fails	no
  labeled javascript	ci/label-runs	dependencies, javascript	no	no
  opened	dependabot/npm_and_yarn/x	dependencies, javascript	no	no

  The flattened condition in d105230 matches a0d9f81's over all 175 combinations of event, branch, labels and added label.

• actionlint 1.7.12 and zizmor 1.31.1 (online audits): no findings. rr check, pnpm test (25 passed), rr pack and gitleaks pass locally.

Merge Danger

Door: two-way

Blast Radius: CI

• Adding a label no longer reruns CI or the workflow audit: rerun a check with gh run rerun.
• A push no longer cancels a Release label run that publishes preview on an older commit: both publish, in turn, and pr-<number> ends on the push's commit.
• No preview publish ran here: the branch is ci/ and the repo has no preview label yet. The table covers the publish paths.

🤖 Generated with Claude Code

https://claude.ai/code/session_018BeR126oZ3YaySwFkXbN23

[changeset-bot]

⚠️ No Changeset found

Latest commit: d105230

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the full diff against main. Label bursts can no longer cancel the required checks, and a preview still publishes once per commit.

• Required checks ignore labels. CI and Workflow audit no longer run on labeled, so a label burst cannot cancel the latest Test or Audit workflows run before its jobs start. Those are the two checks the ruleset requires.
• Release still runs on labeled. A label run gets its own concurrency group, so the run that adds preview is not cancelled by the rest of the burst. Push runs still share a ref group and cancel in progress.
• Preview publishes once per commit. feat/fix still publish on open, sync, and reopen. Other branches publish from the labeled run that adds preview, and again on a later sync or reopen while that label is present. The preview job queues on the PR ref and is not cancelled mid-publish.
• Docs match the trigger. A label runs neither required workflow. Only Release does, and it publishes only when the added label is preview on a non-feat/fix branch.

  ^{｜ View workflow run ｜ Using grok-4.7 ｜ 𝕏}