fix(ci): skip Draft admission for heavy PR workflows

[seonghobae]

Summary

Extend the runner-free Draft lifecycle with the corrected ruleset boundary:

• Security Scan (changed-scope) — Draft skip only for native .github runs
• SAST Semgrep (semgrep) — Draft skip only for native .github runs
• CodeQL PR (detect-languages) — Draft skip only for native .github runs
• Python Security (detect-python) — direct-run Draft guard retained unchanged
• Agent Review Runtime Quality (agent_review_runtime_quality) — direct-run Draft guard retained unchanged

Ruleset boundary

Organization ruleset-launched required workflows ignore their types filter and do not re-trigger on ready_for_review. Therefore Security Scan, SAST Semgrep, and CodeQL use:

github.event.pull_request.draft == false || github.repository != 'ContextualWisdomLab/.github'

In ruleset-targeted repositories, the guard always passes and the required scan still runs while Draft. In native ContextualWisdomLab/.github runs, Draft generations skip the first runner job and native ready_for_review creates the fresh scan. This avoids the security gap observed in newsdom-api#942.

Behavior

• Draft opened, synchronize, and reopened native .github generations skip the first runner-consuming job.
• ready_for_review remains subscribed for native re-entry.
• converted_to_draft remains subscribed so existing PR concurrency cancellation retires prior Ready work.
• SAST Semgrep and Python Security retain their non-PR bypasses; push, schedule, and repository_dispatch behavior remains unchanged.
• CodeQL gates detect-languages, not matrix-consuming analyze-head, preserving the existing matrix/check-name safety boundary.
• Python Security and Runtime Quality are not ruleset-required and intentionally retain direct-run Draft guards without the repository bypass.
• Runtime Quality's existing main branch and path filters remain unchanged.

Documentation and contracts

docs/doctoring/required-workflow-path-filter-boundary.md now records that Draft skipping is .github-local only and that ruleset workflows cannot rely on ready_for_review. Contract tests assert repository guards for the three ruleset-required workflows and assert the direct-run-only workflows remain unguarded by repository identity. The follow-up contract is placed after the stable merge-scheduler contract so applying this branch on top of #2374 does not collide with Strix's test insertion.

Validation

• RED: the five-workflow Draft contract failed before implementation.
• GREEN: focused five-workflow/required-workflow suite with GITHUB_ACTIONS=true — 193 passed.
• go run github.com/rhysd/actionlint/cmd/actionlint@latest passed for all five workflows.
• git diff origin/main...HEAD --check passed.

Developer experience: native .github Draft PRs avoid expensive security runner admission without starving ruleset-targeted required checks.

User experience: Draft-origin PRs in sibling repositories still receive Strix/Security/Semgrep/CodeQL coverage instead of waiting for an unrelated push.

  

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: d5a03825-2417-4d55-93e4-ac8f6255b5b2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

• .github/workflows/agent-review-runtime-quality-ci.yml — GitHub Actions review job
• .github/workflows/codeql-pr.yml — GitHub Actions review job
• .github/workflows/python-security.yml — GitHub Actions review job
• .github/workflows/sast-semgrep.yml — GitHub Actions review job
• .github/workflows/security-scan.yml — GitHub Actions review job
• CHANGELOG.d/20260925-heavy-pr-workflow-draft-admission.md — repository behavior
• docs/doctoring/heavy-pr-workflow-draft-admission.md — operator or user guidance
• docs/doctoring/required-workflow-path-filter-boundary.md — operator or user guidance
• tests/test_docs_only_pr_runner_admission.py — regression suite
• tests/test_required_workflow_queue_contract.py — regression suite

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: agent-review-runtime-quality-ci.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: agent-review-runtime-quality-ci.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Workflow: codeql-pr.yml"]
  S2 --> I2["GitHub Actions review job"]
  I2 --> R2["Review risk: Workflow: codeql-pr.yml"]
  R2 --> V2["actionlint plus required checks"]
  Evidence --> S3["Workflow: python-security.yml"]
  S3 --> I3["GitHub Actions review job"]
  I3 --> R3["Review risk: Workflow: python-security.yml"]
  R3 --> V3["actionlint plus required checks"]
  Evidence --> S4["Workflow: sast-semgrep.yml"]
  S4 --> I4["GitHub Actions review job"]
  I4 --> R4["Review risk: Workflow: sast-semgrep.yml"]
  R4 --> V4["actionlint plus required checks"]
  Evidence --> S5["Workflow: security-scan.yml"]
  S5 --> I5["GitHub Actions review job"]
  I5 --> R5["Review risk: Workflow: security-scan.yml"]
  R5 --> V5["actionlint plus required checks"]
  Evidence --> S6["Repository file: 20260925-heavy-pr-workflow-draft-admission.md"]
  S6 --> I6["repository behavior"]
  I6 --> R6["Review risk: Repository file: 20260925-heavy-pr-workflow-draft-admission.md"]
  R6 --> V6["required checks"]
  Evidence --> S7["Docs: heavy-pr-workflow-draft-admission.md (2 files)"]
  S7 --> I7["operator or user guidance"]
  I7 --> R7["Review risk: Docs: heavy-pr-workflow-draft-admission.md (2 files)"]
  R7 --> V7["docs review"]
  Evidence --> S8["Test: test_docs_only_pr_runner_admission.py (2 files)"]
  S8 --> I8["regression suite"]
  I8 --> R8["Review risk: Test: test_docs_only_pr_runner_admission.py (2 files)"]
  R8 --> V8["targeted test run"]

Loading

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

• Head SHA: 2633197d3ded3417c3acf97291a15a053d2b214b
• Workflow run: 36199038763
• Workflow attempt: 1
• Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: agent-review-runtime-quality-ci.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: agent-review-runtime-quality-ci.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Workflow: codeql-pr.yml"]
  S2 --> I2["GitHub Actions review job"]
  I2 --> R2["Review risk: Workflow: codeql-pr.yml"]
  R2 --> V2["actionlint plus required checks"]
  Evidence --> S3["Workflow: python-security.yml"]
  S3 --> I3["GitHub Actions review job"]
  I3 --> R3["Review risk: Workflow: python-security.yml"]
  R3 --> V3["actionlint plus required checks"]
  Evidence --> S4["Workflow: sast-semgrep.yml"]
  S4 --> I4["GitHub Actions review job"]
  I4 --> R4["Review risk: Workflow: sast-semgrep.yml"]
  R4 --> V4["actionlint plus required checks"]
  Evidence --> S5["Workflow: security-scan.yml"]
  S5 --> I5["GitHub Actions review job"]
  I5 --> R5["Review risk: Workflow: security-scan.yml"]
  R5 --> V5["actionlint plus required checks"]
  Evidence --> S6["Repository file: 20260925-heavy-pr-workflow-draft-admission.md"]
  S6 --> I6["repository behavior"]
  I6 --> R6["Review risk: Repository file: 20260925-heavy-pr-workflow-draft-admission.md"]
  R6 --> V6["required checks"]
  Evidence --> S7["Docs: heavy-pr-workflow-draft-admission.md (2 files)"]
  S7 --> I7["operator or user guidance"]
  I7 --> R7["Review risk: Docs: heavy-pr-workflow-draft-admission.md (2 files)"]
  R7 --> V7["docs review"]
  Evidence --> S8["Test: test_docs_only_pr_runner_admission.py (2 files)"]
  S8 --> I8["regression suite"]
  I8 --> R8["Review risk: Test: test_docs_only_pr_runner_admission.py (2 files)"]
  R8 --> V8["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 2633197d3ded3417c3acf97291a15a053d2b214b
• Workflow run: 36199038763
• Workflow attempt: 1
• Gate result: COVERAGE_BLOCKED
• Coverage gate: failure
• Model pool: unknown
• Verdict: COVERAGE_BLOCKED
• Formal review: fix(ci): skip Draft admission for heavy PR workflows #2376 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.

[seonghobae]

Admission correction — exact head 2633197d3ded3417c3acf97291a15a053d2b214b

Current-head Runtime Quality 36162092418, CodeQL 36162092374, and Python Security 36162092395 are terminally failed; active opencode-agent CHANGES_REQUESTED remains. Canonical foundation successor .github#2385@950ab88553fe7415a73401c7ccc2e4749554395e carries the missing coverage lock, AnyIO audit repair, and CodeQL owner parents. This PR is returned to Draft/Proposed with its exact head preserved.