fix(actions): coalesce redundant queued current-head runs

[seonghobae]

Root cause

Live exact-head evidence showed duplicate queued sets of the same expensive workflows can survive for one unchanged PR branch/head after PR recreation or draft-state changes. The existing live-ref queue hygiene protects newly pushed authoritative heads, but multiple queued runs with the same workflow identity can still consume scarce hosted capacity while all remain superficially current.

This is causal for downstream repositories including ContextualWisdomLab/accounting-information-platform, where exact-head Accounting Foundation/reviewer lanes remain queued while repository-owned security/SAST lanes can already be terminal.

Repair boundary

This PR adds a trusted pull_request_target current-head coalescer for opened, synchronize, reopened, ready_for_review, and converted_to_draft. It checks out only trusted ContextualWisdomLab/.github@github.workflow_sha with persisted credentials disabled, grants only the Actions/contents/PR reads-writes needed for ordinary queued-run cancellation, and never executes PR-head code.

Cancellation authority is deliberately narrow: exact head repository/ref/SHA, exact base repository/ref/SHA, PR association, stable numeric workflow_id, and live queued status must agree. Different open PRs never donate evidence. A closed predecessor may participate only when its live head/base identities exactly equal the successor. The implementation re-fetches active siblings, related PR state and the candidate immediately before ordinary /cancel; it never calls force-cancel. GitHub exposes no conditional queued-only cancel precondition, so the final GET→POST status race remains an explicitly documented platform limit rather than a claimed atomic guarantee.

Current repair state — 2026-09-02

Exact writer head at this refresh: f6b7e07eb38d5cd7db147d5e506a3e6e0f4bcae7 on protected main@7683f1da91f1fc9e046660169f1f7ac4aabcc3c6.

Current review exposed and the branch has now source-fixed a real normalization defect: workflow-run pull_requests[*].head.repo / base.repo associations can use GitHub's minimal embedded repository shape (id, name, canonical API url) and omit full_name, while the live pull-request endpoint supplies the fuller repository object. The old _head_tuple() / _base_tuple() therefore could assign an empty repository identity to otherwise valid Actions associations and preserve duplicate runs indefinitely.

TDD lineage is explicit. RED commits first reproduced the minimal Actions representation for both pull_request and pull_request_target and added malformed-host/scheme/query/path fail-closed cases. Production commit 74cf4989bd305a76ab18fa85acee73fc7b80d9c3 adds _repository_full_name(): a validated full_name is accepted directly; otherwise only a canonical https://api.github.com/repos/{owner}/{repo} URL with no query/fragment is parsed and revalidated. _head_tuple(), _base_tuple(), and ordinary workflow head_repository matching use the same normalization. Current doctoring records the two GitHub REST shapes and the bounded normalization contract.

The original inline finding is now outdated and has an exact-head source/test reply, but fresh reviewer resolution and exact-head workflow results remain authoritative. Do not treat an outdated thread or queued check as implicit success.

Earlier review convergence retained

Already-addressed current-branch findings include exact-base/open-PR isolation, pull_request_target association semantics, ready/draft transition triggers, final candidate status re-fetch, refreshed authoritative sibling state, explicit GH_TOKEN use, per-request timeout, shell-injection-safe workflow inputs, and accurate documentation of the unavoidable cancel API race. Those repairs remain subject to revalidation on the final unchanged head.

Exact-head evidence boundary

The ordinary security, SAST, CodeQL, Python Security, Secret Scan, SBOM, Scorecard and OSV workflows for the current lineage are queued/non-passing under the same saturated Actions fleet this PR is intended to de-amplify. Predecessor results do not transfer. Integrate only when all substantive findings are resolved and ordinary protected admission on one unchanged head permits it.

No self-approval, synthetic status, force push, destructive rebase, required-check suppression, predecessor-evidence transfer, or generalized administrator bypass is authorized.

[coderabbitai]

📝 Walkthrough

Walkthrough

동일한 PR 현재 head에 대한 중복 queued GitHub Actions 실행을 식별하고, 라이브 상태를 재검증한 뒤 취소하는 Python CLI와 pull_request_target 워크플로를 추가했다. 선택 규칙, API 통신, 운영 절차, 회귀 테스트도 추가했다.

Changes

현재 PR 헤드 실행 병합

Layer / File(s)	Summary
실행 선택 및 라이브 상태 검증 scripts/ci/current_head_run_coalescer.py, tests/test_current_head_run_coalescer.py	실행의 PR head 신원을 검증하고, 동일 workflow_id의 중복 queued 실행만 선택한다. in_progress 실행과 단독 queued 실행은 보존한다. 취소 전 상태가 변경되면 CoalescingRefused로 처리를 중단한다.
GitHub API 조회 및 취소 흐름 scripts/ci/current_head_run_coalescer.py, tests/test_current_head_run_coalescer.py	gh CLI로 PR과 실행을 조회하고 queued 및 in-progress 실행을 페이지네이션한다. 후보 실행을 다시 조회한 뒤 일반 /cancel 엔드포인트로 취소한다. CLI 인자와 진입점도 추가했다.
신뢰된 워크플로 연결 및 운영 검증 .github/workflows/current-head-run-coalescer.yml, docs/doctoring/current-head-run-coalescing.md, tests/test_current_head_run_coalescer.py	pull_request_target 이벤트와 최소 권한을 사용하는 워크플로를 추가했다. 신뢰된 github.workflow_sha 소스를 체크아웃한다. 취소 불변식, 장애 대응, 롤백 절차와 관련 테스트를 문서화했다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟠 High · up to c6c71

This PR adds privileged automation that coalesces duplicate workflow runs, but its current implementation can execute attacker-controlled branch metadata and may cancel a run after it has started. That could disrupt unrelated repository Actions runs, so the PR is not safe to merge until the shell boundary and cancellation race are fixed.

Sequence Diagram(s)

sequenceDiagram
  participant PR as GitHub PR
  participant Workflow as current-head-run-coalescer.yml
  participant Coalescer as coalesce
  participant Actions as GitHub Actions API
  PR->>Workflow: opened, synchronize 또는 reopened 이벤트
  Workflow->>Coalescer: 저장소, PR 번호, head 정보 전달
  Coalescer->>Actions: PR 및 활성 실행 조회
  Coalescer->>Actions: 후보 실행과 라이브 상태 재조회
  Coalescer->>Actions: 중복 queued 실행 취소

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 93.33% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 30 functions across 2 files. (2 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 중복된 queued current-head 실행을 통합하고 취소하는 핵심 변경을 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 93.33% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 30 functions across 2 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/current-head-run-coalescing-20260902

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 new potential issues.

[seonghobae]

Minimum-safe queue-saturation admission record for exact head f6b7e07eb38d5cd7db147d5e506a3e6e0f4bcae7 against base 7683f1da91f1fc9e046660169f1f7ac4aabcc3c6: PR is mechanically mergeable; all current review threads are resolved; CodeRabbit and Devin current-head commit statuses are success; no CHANGES_REQUESTED review is present; the latest reviewer findings were either source-fixed with regressions or confirmed non-actionable due GitHub's lack of an atomic queued-only cancel precondition. The remaining current-head security/SAST/CodeQL/SBOM/Scorecard/OSV/Secret/Python workflows are all queued under the exact capacity pathology this PR repairs. Live repository ruleset 17921150 requires thread resolution with 0 approvals and reports current_user_can_bypass=always via OrganizationAdmin. No predecessor check is being transferred. If integration proceeds, it is solely to break the proven self-hosting queue-saturation cycle and downstream PRs must be re-fetched on the new protected-main head.

[seonghobae]

QUEUE_SATURATION_CHICKEN_EGG admission decision for exact head f6b7e07eb38d5cd7db147d5e506a3e6e0f4bcae7 against protected main@7683f1da91f1fc9e046660169f1f7ac4aabcc3c6.

Fresh evidence immediately before integration:

• GitHub reports the PR Ready and mechanically mergeable with no conflict.
• Every inline review thread is resolved. The latest normalization finding is source-fixed with RED fixtures for the real minimal Actions pull_requests[*].head.repo / base.repo representation and the final Devin review resolves it; later exact-head Devin findings are informational only. CodeRabbit's residual GET→POST cancellation race was independently revalidated as a GitHub API limitation and its thread is resolved.
• Exact-head CodeRabbit and Devin commit statuses are both success; no exact-head check run reports a substantive failure.
• The remaining Actions evidence is queued. This repository currently has 1,150 queued workflow runs. The current fix(actions): coalesce redundant queued current-head runs #1645 lineage itself has required scheduler/security/quality work still queued.
• This PR is the causal capacity repair: it adds a trusted pull_request_target coalescer that removes redundant queued same-current-head workflow runs only after exact repository/ref/SHA/base/PR/workflow identity and refreshed sibling/candidate state agree. It never executes PR-head code with privileged credentials and never calls force-cancel.

Ordinary admission therefore depends on scarce queue capacity that this exact repair is designed to recover. No failing test, security finding, meaningful CHANGES_REQUESTED, provenance defect, or merge conflict is being bypassed. Integration will use the exact expected head SHA; after merge protected main and affected queue state will be re-read immediately.