From c8e275a9db9e0e431e6024c150b2b2201f912d3a Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Thu, 5 Nov 2026 15:03:20 -0500 Subject: [PATCH 1/3] ci: keep label bursts from hiding the required checks CI and Workflow audit no longer run on `labeled`: neither reads a label, and a label run cancelled before any job started left Test or Audit workflows unreported. Release keeps `labeled` for `preview`: each label run gets a concurrency group of its own, a label run publishes only when it adds `preview` to a branch other than feat/fix, and Publish preview queues in a job-level group. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_018BeR126oZ3YaySwFkXbN23 --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 17 +++++++++++++++-- .github/workflows/workflow-audit.yml | 2 +- docs/development.md | 2 +- 4 files changed, 18 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0af011f..2f2bad3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,8 +1,8 @@ name: CI on: + # Not on `labeled`: CI reads no label, and labels added at once could cancel the run GitHub reads Test from. pull_request: - types: [opened, synchronize, reopened, labeled] branches: - main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f1a8999..9fd10b5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,8 +11,9 @@ on: permissions: {} +# Each label run gets a group of its own, so labels added at once can't cancel the run that adds `preview`. concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: ${{ github.workflow }}-${{ github.event.action == 'labeled' && github.run_id || github.ref }} cancel-in-progress: true jobs: @@ -70,7 +71,19 @@ jobs: # Runs PR code: never give this job the bot key. preview: name: Publish preview - if: ${{ github.event_name == 'pull_request' && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix') || contains(github.event.pull_request.labels.*.name, 'preview')) }} + # Opened, synchronize and reopened runs publish on a feat/fix branch or with `preview`; a label run only when it adds `preview` to any other branch. + if: >- + ${{ github.event_name == 'pull_request' + && ((github.event.action == 'labeled' + && github.event.label.name == 'preview' + && !startsWith(github.head_ref, 'feat') && !startsWith(github.head_ref, 'fix')) + || (github.event.action != 'labeled' + && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix') + || contains(github.event.pull_request.labels.*.name, 'preview')))) }} + # One publish to `pr-` at a time: label runs don't share the workflow's group. + concurrency: + group: ${{ github.workflow }}-preview-${{ github.ref }} + cancel-in-progress: false runs-on: ubuntu-latest permissions: id-token: write # npm trusted publishing (OIDC) diff --git a/.github/workflows/workflow-audit.yml b/.github/workflows/workflow-audit.yml index eeb293e..ab5a79c 100644 --- a/.github/workflows/workflow-audit.yml +++ b/.github/workflows/workflow-audit.yml @@ -1,8 +1,8 @@ name: Workflow audit on: + # Not on `labeled`: zizmor reads no label, and labels added at once could cancel the run GitHub reads Audit workflows from. pull_request: - types: [opened, synchronize, reopened, labeled] branches: - main diff --git a/docs/development.md b/docs/development.md index f0f65d4..47301b3 100644 --- a/docs/development.md +++ b/docs/development.md @@ -27,6 +27,6 @@ The suite in `test/functional` runs in Vitest Browser Mode with Playwright. It c ## CI -- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools, then runs `pnpm rr check`, `pnpm test` and the build with `pnpm rr pack`. Beside them, gitleaks scans the pull request's commits for secrets, and the required `Test` check passes when both do. Workflow audit runs zizmor on the workflows. +- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools, then runs `pnpm rr check`, `pnpm test` and the build with `pnpm rr pack`. Beside them, gitleaks scans the pull request's commits for secrets, and the required `Test` check passes when both do. Workflow audit runs zizmor on the workflows. Adding a label runs neither: of the pull request workflows only Release runs on it, its label runs don't cancel one another, and only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview. - **Git hooks** ([lefthook](https://lefthook.dev)): `lefthook.yml` extends `lefthook/base.yml` from `@rrlab/cli`, whose jobs are listed in [its README](https://github.com/withvariablelab/dx/blob/main/run-run/cli/README.md#git-hooks), and its own `shared-hooks` job fails a commit, saying to run `pnpm install`, when that file is missing from `node_modules`. On commit, in parallel: Biome's fixes on the staged files, the type check when a TypeScript file or a tsconfig changes, and gitleaks on the staged changes. On push, the tests. - **Every Monday:** `pnpm audit` on the lockfile, which keeps an issue labeled `dependency-audit` open while it finds known vulnerabilities (Dependency audit). From a0d9f8163f78cd2ac9e44725bd18c4b1662a8f89 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Thu, 5 Nov 2026 15:08:22 -0500 Subject: [PATCH 2/3] ci: leave a preview added at creation to its label run A PR created with `preview` gets `opened` and `labeled preview`; when the opened payload already lists the label, both runs published the same commit and the second failed. `opened` now leaves `preview` to the label run. Shorter workflow comments, and the docs write branch prefixes as contributing.md does. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_018BeR126oZ3YaySwFkXbN23 --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/workflow-audit.yml | 2 +- docs/development.md | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2f2bad3..dd26552 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,7 +1,7 @@ name: CI on: - # Not on `labeled`: CI reads no label, and labels added at once could cancel the run GitHub reads Test from. + # Not on `labeled`: CI reads no label, and a label run cancelled before its jobs start hides Test. pull_request: branches: - main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9fd10b5..9dddc61 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -71,7 +71,7 @@ jobs: # Runs PR code: never give this job the bot key. preview: name: Publish preview - # Opened, synchronize and reopened runs publish on a feat/fix branch or with `preview`; a label run only when it adds `preview` to any other branch. + # One publish per commit: feat/fix pushes publish, and `preview` from the label run that adds it or a later push. if: >- ${{ github.event_name == 'pull_request' && ((github.event.action == 'labeled' @@ -79,7 +79,7 @@ jobs: && !startsWith(github.head_ref, 'feat') && !startsWith(github.head_ref, 'fix')) || (github.event.action != 'labeled' && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix') - || contains(github.event.pull_request.labels.*.name, 'preview')))) }} + || (github.event.action != 'opened' && contains(github.event.pull_request.labels.*.name, 'preview'))))) }} # One publish to `pr-` at a time: label runs don't share the workflow's group. concurrency: group: ${{ github.workflow }}-preview-${{ github.ref }} diff --git a/.github/workflows/workflow-audit.yml b/.github/workflows/workflow-audit.yml index ab5a79c..54fed4d 100644 --- a/.github/workflows/workflow-audit.yml +++ b/.github/workflows/workflow-audit.yml @@ -1,7 +1,7 @@ name: Workflow audit on: - # Not on `labeled`: zizmor reads no label, and labels added at once could cancel the run GitHub reads Audit workflows from. + # Not on `labeled`: zizmor reads no label, and a label run cancelled before its jobs start hides Audit workflows. pull_request: branches: - main diff --git a/docs/development.md b/docs/development.md index 47301b3..b2bd5aa 100644 --- a/docs/development.md +++ b/docs/development.md @@ -27,6 +27,6 @@ The suite in `test/functional` runs in Vitest Browser Mode with Playwright. It c ## CI -- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools, then runs `pnpm rr check`, `pnpm test` and the build with `pnpm rr pack`. Beside them, gitleaks scans the pull request's commits for secrets, and the required `Test` check passes when both do. Workflow audit runs zizmor on the workflows. Adding a label runs neither: of the pull request workflows only Release runs on it, its label runs don't cancel one another, and only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview. +- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools, then runs `pnpm rr check`, `pnpm test` and the build with `pnpm rr pack`. Beside them, gitleaks scans the pull request's commits for secrets, and the required `Test` check passes when both do. Workflow audit runs zizmor on the workflows. Adding a label runs neither: of the pull request workflows only Release runs on it, its label runs don't cancel one another, and only one that adds `preview` to a branch other than `feat/` or `fix/` publishes a preview. - **Git hooks** ([lefthook](https://lefthook.dev)): `lefthook.yml` extends `lefthook/base.yml` from `@rrlab/cli`, whose jobs are listed in [its README](https://github.com/withvariablelab/dx/blob/main/run-run/cli/README.md#git-hooks), and its own `shared-hooks` job fails a commit, saying to run `pnpm install`, when that file is missing from `node_modules`. On commit, in parallel: Biome's fixes on the staged files, the type check when a TypeScript file or a tsconfig changes, and gitleaks on the staged changes. On push, the tests. - **Every Monday:** `pnpm audit` on the lockfile, which keeps an issue labeled `dependency-audit` open while it finds known vulnerabilities (Dependency audit). From d1052300b4a92e7dc48fca5ad955bfc4ea558637 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Thu, 5 Nov 2026 15:11:37 -0500 Subject: [PATCH 3/3] ci: flatten the preview condition to one clause per rule Same truth table: a feat/fix push publishes, a label run when it adds `preview` to another branch, and a synchronize or reopened run when the PR has `preview`. The docs sentence drops the concurrency detail. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_018BeR126oZ3YaySwFkXbN23 --- .github/workflows/release.yml | 11 +++++------ docs/development.md | 2 +- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9dddc61..ad365a4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -74,12 +74,11 @@ jobs: # One publish per commit: feat/fix pushes publish, and `preview` from the label run that adds it or a later push. if: >- ${{ github.event_name == 'pull_request' - && ((github.event.action == 'labeled' - && github.event.label.name == 'preview' - && !startsWith(github.head_ref, 'feat') && !startsWith(github.head_ref, 'fix')) - || (github.event.action != 'labeled' - && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix') - || (github.event.action != 'opened' && contains(github.event.pull_request.labels.*.name, 'preview'))))) }} + && ((github.event.action != 'labeled' && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix'))) + || (github.event.action == 'labeled' && github.event.label.name == 'preview' + && !(startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix'))) + || ((github.event.action == 'synchronize' || github.event.action == 'reopened') + && contains(github.event.pull_request.labels.*.name, 'preview'))) }} # One publish to `pr-` at a time: label runs don't share the workflow's group. concurrency: group: ${{ github.workflow }}-preview-${{ github.ref }} diff --git a/docs/development.md b/docs/development.md index b2bd5aa..35c1dc7 100644 --- a/docs/development.md +++ b/docs/development.md @@ -27,6 +27,6 @@ The suite in `test/functional` runs in Vitest Browser Mode with Playwright. It c ## CI -- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools, then runs `pnpm rr check`, `pnpm test` and the build with `pnpm rr pack`. Beside them, gitleaks scans the pull request's commits for secrets, and the required `Test` check passes when both do. Workflow audit runs zizmor on the workflows. Adding a label runs neither: of the pull request workflows only Release runs on it, its label runs don't cancel one another, and only one that adds `preview` to a branch other than `feat/` or `fix/` publishes a preview. +- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools, then runs `pnpm rr check`, `pnpm test` and the build with `pnpm rr pack`. Beside them, gitleaks scans the pull request's commits for secrets, and the required `Test` check passes when both do. Workflow audit runs zizmor on the workflows. Adding a label runs neither: only Release runs on it, and it publishes a preview when the label is `preview` and the branch isn't `feat/` or `fix/`. - **Git hooks** ([lefthook](https://lefthook.dev)): `lefthook.yml` extends `lefthook/base.yml` from `@rrlab/cli`, whose jobs are listed in [its README](https://github.com/withvariablelab/dx/blob/main/run-run/cli/README.md#git-hooks), and its own `shared-hooks` job fails a commit, saying to run `pnpm install`, when that file is missing from `node_modules`. On commit, in parallel: Biome's fixes on the staged files, the type check when a TypeScript file or a tsconfig changes, and gitleaks on the staged changes. On push, the tests. - **Every Monday:** `pnpm audit` on the lockfile, which keeps an issue labeled `dependency-audit` open while it finds known vulnerabilities (Dependency audit).