merge(main): adopt protected PR concurrency repair for release cut

Author: seonghobae

.github/workflows/cflite_pr.yml

@@ -2,6 +2,7 @@ name: ClusterFuzzLite PR fuzzing
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     paths:
       - ".clusterfuzzlite/**"
       - ".github/workflows/cflite_pr.yml"
@@ -14,12 +15,13 @@ permissions:
 
 jobs:
   PR:
+    if: ${{ !github.event.pull_request.draft && github.event.action != 'closed' }}
     runs-on: ubuntu-24.04
     permissions:
       contents: read
       security-events: write
     concurrency:
-      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
+      group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
       cancel-in-progress: true
     strategy:
       fail-fast: false

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches: [main, develop]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
 
 permissions:
   contents: read
@@ -12,14 +13,15 @@ concurrency:
   # Keep one active CI run per PR while preserving independent push runs. A
   # synchronized head cancels its queued/running predecessor instead of
   # multiplying the hosted-runner backlog with stale evidence.
-  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # Matrix legs report as "python (3.12)" / "python (3.14)". Branch protection
   # still requires the exact check context name `python`, so a thin aggregate
   # job below re-exports matrix success under that name.
   python-matrix:
+    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
     name: python (${{ matrix.python-version }})
     runs-on: ubuntu-latest
     strategy:
@@ -46,7 +48,7 @@ jobs:
   python:
     name: python
     needs: python-matrix
-    if: always()
+    if: ${{ always() && (github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed')) }}
     runs-on: ubuntu-latest
     steps:
       - name: Require every CPython matrix leg
@@ -56,6 +58,7 @@ jobs:
 
 
   rust:
+    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
@@ -72,6 +75,7 @@ jobs:
       - run: cargo test --manifest-path crates/fast-mlsirm-py/Cargo.toml
 
   gpu-smoke:
+    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
     # One bounded explicit-GPU parity test remains on every PR. The full
     # paper-design GPU recovery study runs in the scheduled/manual workflow.
     runs-on: ubuntu-latest
@@ -152,6 +156,7 @@ jobs:
           PY
 
   fuzz:
+    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
     # Short, bounded coverage-guided fuzzing so PR cost stays low. The
     # property-based Hypothesis tests already run in the `python` job (via the
     # dev extra); this job adds the Atheris coverage-guided harnesses with a
@@ -184,6 +189,7 @@ jobs:
             -max_total_time=60 -timeout=25 fuzz/corpus/config
 
   package:
+    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.event.action != 'closed') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

tests/test_cflite_concurrency_contract.py

@@ -0,0 +1,19 @@
+"""Contract test for pull-request fuzzing concurrency."""
+
+from pathlib import Path
+
+
+def test_cflite_cancels_only_the_superseded_head_for_one_repository_pr() -> None:
+    workflow = (
+        Path(__file__).parents[1] / ".github" / "workflows" / "cflite_pr.yml"
+    ).read_text(encoding="utf-8")
+
+    assert (
+        "group: ${{ github.workflow }}-${{ github.repository }}-"
+        "${{ github.event.pull_request.number }}"
+    ) in workflow
+    assert "cancel-in-progress: true" in workflow
+    assert "ready_for_review" in workflow
+    assert "converted_to_draft" in workflow
+    assert "github.event.pull_request.draft" in workflow
+    assert "github.event.action != 'closed'" in workflow

tests/test_ci_concurrency_contract.py

@@ -3,13 +3,14 @@
 from __future__ import annotations
 
 from pathlib import Path
+import re
 from typing import Any
 
 
 _WORKFLOW = Path(__file__).parents[1] / ".github" / "workflows" / "ci.yml"
 _EXPECTED_GROUP = (
-    "ci-${{ github.workflow }}-"
-    "${{ github.event.pull_request.number || github.ref }}"
+    "${{ github.workflow }}-${{ github.repository }}-"
+    "${{ github.event.pull_request.number || github.run_id }}"
 )
 
 
@@ -65,13 +66,40 @@ def test_ci_cancels_superseded_runs_for_the_same_pull_request():
     concurrency = _top_level_mapping("concurrency")
     assert concurrency == {
         "group": _EXPECTED_GROUP,
-        "cancel-in-progress": True,
+        "cancel-in-progress": "${{ github.event_name == 'pull_request' }}",
     }
 
 
-def test_ci_push_runs_remain_scoped_by_ref():
-    """Main/develop push evidence cannot cancel an unrelated branch or PR run."""
+def test_ci_push_runs_remain_independent():
+    """Main/develop push evidence cannot replace pending release evidence."""
     group = _top_level_mapping("concurrency")["group"]
     assert group == _EXPECTED_GROUP
+    assert "github.repository" in group
     assert "github.event.pull_request.head.sha" not in group
-    assert "github.run_id" not in group
+    assert "github.run_id" in group
+    assert _top_level_mapping("concurrency")["cancel-in-progress"] == (
+        "${{ github.event_name == 'pull_request' }}"
+    )
+
+
+def test_ci_skips_expensive_jobs_for_inactive_pull_requests():
+    workflow = _WORKFLOW.read_text(encoding="utf-8")
+    assert (
+        "types: [opened, synchronize, reopened, ready_for_review, "
+        "converted_to_draft, closed]"
+    ) in workflow
+    for job_name in (
+        "python-matrix",
+        "python",
+        "rust",
+        "gpu-smoke",
+        "fuzz",
+        "package",
+    ):
+        match = re.search(
+            rf"(?ms)^  {re.escape(job_name)}:\n(.*?)(?=^  \S|\Z)", workflow
+        )
+        assert match is not None
+        job = match.group(1)
+        assert "!github.event.pull_request.draft" in job
+        assert "github.event.action != 'closed'" in job