fix(actions): coalesce Wardnet PR validation slots

[seonghobae]

결과

Wardnet의 저장소 전용 PR 검증 슬롯을 줄입니다.

• CI와 Fuzz는 고정 workflow명-repository-PR번호 group을 사용하며 같은 PR의 구형 head만 취소합니다.
• push·schedule·manual 실행은 PR group과 분리하고 취소하지 않습니다.
• Fuzz의 4-job matrix를 한 runner의 네 target 순차 실행으로 바꿔, 해당 PR push의 local job 수를 5개에서 2개로 줄였습니다.
• 별도 duration step을 없애고 cache hit 때 cargo-fuzz 재설치를 건너뜁니다. 설치 실패를 숨기던 || true도 제거했습니다.
• 기존 #153의 ubuntu-24.04 고정과 실행 계약을 정확히 승계했습니다. CI/Fuzz/Scorecard는 더 이상 ubuntu-latest를 사용하지 않습니다.

중앙 required workflow 대조

ContextualWisdomLab/.github@769691526f8c73cf714de8fe8ba51ae6cfa2901a와 조직 ruleset 18156473을 대조했습니다. 중앙 required workflow 7개는 OpenCode, PR review/merge scheduler, Security Scan, Strix, SAST Semgrep, Noema, CodeQL PR입니다. Wardnet main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128에는 local PR Governance, Dependency Review, Close Empty PR, CodeQL, Security Scan, SAST, Strix, OpenCode, Noema workflow가 이미 없습니다.

Local Scorecard는 삭제하지 않습니다. PR 중복이 아니라 main push·주간·branch-protection 증거를 소유하며 Wardnet은 v2.4.4를 사용합니다. 지정 중앙 reusable workflow는 v2.4.3이라 지금 위임하면 보안 스캐너가 낮아집니다. 이 때문에 기존 #160은 이 PR과 중복되는 적체 해결책이 아니라 비약화 조건을 위반하는 후보입니다.

검증

• base: cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128
• head: 8dc374ed597292a9d97a25e7cdea832b5990b6dd
• cargo fmt --check
• cargo test --locked --workspace: 157 passed
• cargo clippy --locked --workspace --all-targets -- -D warnings
• local workflow 3개 actionlint
• git diff --check origin/main...HEAD
• 첫 측정: queued 156건, local CI 20건, Fuzz workflow 3건
• native cancellation: CI/Fuzz run 33875121820/33875121875와 33875211386/33875211398이 후속 head에서 completed/cancelled; 최신 head 실행만 유지

Self-approval, force push, review dismissal, required gate 변경은 사용하지 않았습니다.

[coderabbitai]

📝 Walkthrough

Walkthrough

CI 워크플로우에 동시성 그룹을 추가했습니다. 동일 그룹에서 새 pull request 실행이 시작되면 진행 중인 실행을 취소합니다.

Changes

CI 동시성 제어

Layer / File(s)	Summary
워크플로우 동시성 설정 .github/workflows/ci.yml	github.workflow와 pull request 번호 또는 ref를 조합해 실행 그룹을 지정합니다. pull_request 이벤트에서는 진행 중인 실행을 취소합니다.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: 🟡 Moderate · up to f7abb

Rapid pushes to the same branch can replace pending CI runs, so independent main-branch validation may be skipped. Update the push grouping before merge or explicitly accept this bounded CI correctness risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 검증 워크플로우에 동시성 제어를 추가하고, 대체된 실행을 취소하는 변경을 제목이 정확하게 설명합니다.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/ci-cancel-stale-pr

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh dependency/ownership review: this PR's unique concurrency delta is useful, but its current head f7abbe6abd020a328ff4b6bfe2970e2870922a2c starts from protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128 and therefore still carries the floating ubuntu-latest / stable CI declarations that #153/#77 are independently repairing. Do not merge this head as-is or close it; preserve the concurrency delta and restack/reconstruct it non-destructively after the runner/toolchain dependency roots reach protected main (or onto their verified successor lineage). Predecessor checks/reviews do not transfer. Acceptance after restack: PR-scoped cancel-in-progress remains true only for pull_request; push-to-main remains independent; all then-live explicit runner/toolchain pins remain intact; exact-head CI/security/central gates are reacquired.

[cwl-noema-review]

Noema LLM review

The PR correctly adds concurrency control that cancels superseded pull request runs while leaving main-branch push runs intact. Pull request runs share a group keyed by PR number, while each push run gets a unique group via github.run_id, so event types cannot interfere. cancel-in-progress is scoped to pull_request events only, so push runs queue rather than being canceled.

Reviewed changed lines

• .github/workflows/ci.yml:12 (RIGHT): Concurrency group expression falls back to github.run_id for push events and uses the PR number for pull requests, producing disjoint namespaces with no cross-event cancellation risk.
• .github/workflows/ci.yml:13 (RIGHT): cancel-in-progress is true only for pull_request events; push events evaluate to false, so main-branch runs are queued rather than canceled.

Adversarial validation

• .github/workflows/ci.yml:12 (RIGHT) falsified: A push to main after a PR's CI run starts cancels the PR run because both share the same concurrency group — For pull_request events, github.event.pull_request.number is set, yielding a group such as CI-42. For push events, that expression is empty and falls back to github.run_id, a unique run identifier. The two namespaces cannot collide.
• .github/workflows/ci.yml:13 (RIGHT) falsified: Rapid pushes to main cancel pending main-branch CI runs, causing some commits to lack CI status — cancel-in-progress evaluates to github.event_name == 'pull_request'. For push events, github.event_name is 'push', so the expression is false. GitHub Actions queues pending runs when cancel-in-progress is false.
• Residual risk: Low. The change is a minimal CI workflow configuration edit. Residual risk is limited to GitHub Actions expression behavior and possible future workflow edits that reuse the concurrency group definition.

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: 89176e2cc57088e4d772de9b1686ab89a3e69aeb
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]