fix(ci): preserve required PR evidence (#1426)

* fix(ci): preserve required PR evidence

* style(ci): format workflow policy test

* fix(ci): validate cancelled benchmark dependencies

* fix(ci): cancel superseded pull request runs

* fix(ci): fail closed on cancelled aggregate jobs

* fix(benchmarks): normalize cancelled validation inputs

* style(ci): format cancellation policy assertions

Author: morluto

.github/workflows/benchmarks.yml

@@ -14,6 +14,8 @@ on:
 
 concurrency:
   group: benchmarks-${{ github.workflow }}-${{ github.ref }}
+  # A newer PR commit supersedes stale evidence; Benchmark Validation still
+  # runs after dependency cancellation and rejects missing evidence.
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
@@ -317,6 +319,9 @@ jobs:
 
   validation:
     name: Benchmark Validation
+    # This required aggregate must run after cancellation so the validator can
+    # turn cancelled dependencies into a failing check instead of a skipped,
+    # branch-protection-passing job.
     if: ${{ always() }}
     needs: [plan, static, contracts, host_validation, inventory, oracle]
     runs-on: ubuntu-latest
@@ -370,11 +375,11 @@ jobs:
             --execution-sha "${{ github.sha }}" \
             --receipt-root "${{ runner.temp }}/benchmark-validation/host" \
             --timings "${{ runner.temp }}/benchmark-validation/timing/benchmark-test-durations.json" \
-            --lane "static:$PLAN_CHECK:$STATIC_RESULT" \
-            --lane "contracts:$RECORD_SCHEMA_FLAG:$CONTRACTS_RESULT" \
-            --lane "host-validation:$HOST_VALIDATION_FLAG:$HOST_VALIDATION_RESULT" \
-            --lane "inventory:$INVENTORY_FLAG:$INVENTORY_RESULT" \
-            --lane "oracle:$ORACLE_FLAG:$ORACLE_RESULT"
+            --lane "static:${PLAN_CHECK:-false}:${STATIC_RESULT:-cancelled}" \
+            --lane "contracts:${RECORD_SCHEMA_FLAG:-false}:${CONTRACTS_RESULT:-cancelled}" \
+            --lane "host-validation:${HOST_VALIDATION_FLAG:-false}:${HOST_VALIDATION_RESULT:-cancelled}" \
+            --lane "inventory:${INVENTORY_FLAG:-false}:${INVENTORY_RESULT:-cancelled}" \
+            --lane "oracle:${ORACLE_FLAG:-false}:${ORACLE_RESULT:-cancelled}"
 
   timings:
     name: Publish Benchmark Timings

.github/workflows/ci.yml

@@ -12,6 +12,8 @@ on:
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
+  # A newer PR commit supersedes stale evidence; the required aggregate must
+  # still fail closed if cancellation reaches its dependencies.
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
@@ -213,7 +215,7 @@ jobs:
 
   coverage:
     name: Coverage
-    if: ${{ always() && !cancelled() }}
+    if: ${{ always() }}
     needs: [python, boundaries, subprocess_coverage]
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -296,7 +298,7 @@ jobs:
 
   required:
     name: required
-    if: ${{ always() && !cancelled() }}
+    if: ${{ always() }}
     needs: [static, python, boundaries, wheel, coverage, lean]
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -319,7 +321,7 @@ jobs:
 
   python-test:
     name: Python Tests
-    if: ${{ always() && !cancelled() }}
+    if: ${{ always() }}
     needs: [required]
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -331,7 +333,7 @@ jobs:
 
   lean-test:
     name: Lean Tests
-    if: ${{ always() && !cancelled() }}
+    if: ${{ always() }}
     needs: [lean]
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -343,7 +345,7 @@ jobs:
 
   deployment-test:
     name: Deployment Tests
-    if: ${{ always() && !cancelled() }}
+    if: ${{ always() }}
     needs: [static]
     runs-on: ubuntu-latest
     timeout-minutes: 5

tests/unit/tooling/test_ci_execution_policy.py

@@ -286,14 +286,15 @@ def test_plan_receipt_digests_are_rendered_as_markdown_code() -> None:
     assert "Plan receipt: \\\\`$(python" not in workflow
 
 
-def test_required_ci_gates_fail_closed_without_extending_cancelled_runs() -> None:
+def test_required_ci_gates_fail_closed_after_cancellation() -> None:
     workflow = (ROOT / ".github/workflows/ci.yml").read_text(encoding="utf-8")
     required = workflow.split("  required:", 1)[1].split("  python-test:", 1)[0]
     aggregate_tail = workflow.split("  required:", 1)[1]
 
     assert "treating gate as non-failure" not in workflow
-    assert "if: ${{ always() }}" not in aggregate_tail
-    assert aggregate_tail.count("if: ${{ always() && !cancelled() }}") == 4
+    assert aggregate_tail.count("if: ${{ always() }}") == 4
+    assert "if: ${{ always() && !cancelled() }}" not in aggregate_tail
+    assert "if: ${{ always() }}" in required
     assert "name: required" in workflow
     assert "name: Python Tests" in workflow
     assert "name: Lean Tests" in workflow
@@ -307,6 +308,27 @@ def test_required_ci_gates_fail_closed_without_extending_cancelled_runs() -> Non
     assert "JACOBIAN_LEAN_REQUIRED" in lean_job
 
 
+def test_required_pr_workflows_cancel_stale_evidence() -> None:
+    ci = (ROOT / ".github/workflows/ci.yml").read_text(encoding="utf-8")
+    benchmarks = (ROOT / ".github/workflows/benchmarks.yml").read_text(encoding="utf-8")
+
+    expected_concurrency = (
+        "cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
+    )
+    assert expected_concurrency in ci
+    assert expected_concurrency in benchmarks
+    validation = benchmarks.split("  validation:", 1)[1].split("  timings:", 1)[0]
+    assert "if: ${{ always() }}" in validation
+    assert "if: ${{ always() && !cancelled() }}" not in validation
+    assert (
+        '--lane "static:${PLAN_CHECK:-false}:${STATIC_RESULT:-cancelled}"' in validation
+    )
+    assert (
+        '--lane "oracle:${ORACLE_FLAG:-false}:${ORACLE_RESULT:-cancelled}"'
+        in validation
+    )
+
+
 def test_subprocess_coverage_is_owned_by_one_focused_worker_lane() -> None:
     workflow = (ROOT / ".github/workflows/ci.yml").read_text(encoding="utf-8")
     pyproject = (ROOT / "pyproject.toml").read_text(encoding="utf-8")