fix(ci): coalesce superseded Docker PR image validations

[seonghobae]

Goal

docker-publish.yml의 PR validation queue를 coalesce하되, 새 PR event가 사용자가 의도적으로 재실행한 older-head run을 취소하지 않도록 generation identity를 분리합니다. Tag publication은 계속 non-cancellable입니다.

Current authority

• protected base: develop@042b0c70531b229af3acbd0421a2f23098d848b3
• exact head: b2ee42b6e9286aac4b908a644f472c71d9ccc2a6
• lifecycle: Ready / independently approved / mergeable / not merge-authorized
• effective files: .github/workflows/docker-publish.yml, backend/tests/test_release_governance.py, backend/tests/test_docker_workflow_concurrency.py

Review → RED → repair

Original head 1963c8c01407565df5db615692473c67e5f93a32 grouped every pull-request run only by PR number. That coalesces superseded first-attempt runs, but it also places a manual rerun of an older head in the same cancellation group as a later PR event.

• RED 8ef19470fa2af62b05f4920ecc4db0a9e3cf1bf6 added a focused regression requiring reruns to have a distinct concurrency generation from first-attempt PR validation.
• First causal fix 54b09513908b07cbbb72628d0057eaa6afb8bb6e adopted the already-established Bandit run_attempt/run_id isolation pattern.
• Hosted Application CI on exact 54b095... reproduced a separate contract mismatch: backend lint passed, but the full backend suite ended 1 failed / 1807 passed / 32 skipped because test_release_governance.py still asserted the original coarse Docker group string. This was treated as a real RED rather than bypassed.
• 145e8b2134d3b6a5c642cb76a18858583337da79 refined the focused regression so the existing release-governance scope remains meaningful while a new test proves the bare PR-only cancellation group cannot return.
• Exact current fix b2ee42b6e9286aac4b908a644f472c71d9ccc2a6 uses a PR/ref scope plus a generation suffix: first-attempt PR runs share first-attempt; manual reruns use their stable github.run_id. New PR events therefore supersede only first attempts. Tag pushes also get a unique run identity while cancel-in-progress remains false for push events.

Current workflow contract:

concurrency:
  group: docker-publish-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && 'first-attempt' || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

This PR does not change Bandit ownership (#1554), PR Governance (#1589), deploy semantics, image content, release tag publication, or canonical .github CodeQL control-plane behavior.

Exact-head evidence

For unchanged b2ee42b6... the repository-owned validation is terminal:

• Application CI 34157349525 — success. Backend lint/full tests passed; frontend tests, lint, build, and full-product Playwright smoke also passed.
• Bandit Security Scan 34157349506 — success.
• Security Scan 34157349569 — success.
• SAST Semgrep 34157349508 — success.
• Build and Publish Docker Images 34157349758 — success. Required validate backend image, validate frontend image, and validate naruon image jobs all completed successfully without publishing PR images.
• CodeQL PR 34157349575 — failure at the existing canonical terminal-verdict bridge. This is not treated as a demonstrated Naruon source-analysis finding. The central owner remains ContextualWisdomLab/.github#1929; related dispatcher-identity evidence is also tracked in .github#1927. Naruon does not synthesize status, widen central authorization, copy the control plane, or weaken the required context.

CodeRabbit submitted formal APPROVED review PRR_kwDOSNjZ2s8AAAABMhQnlg at 2026-09-07T20:43:05Z on this unchanged exact head. Fresh inline review-thread inventory is empty. The independent-review requirement is therefore satisfied for this exact head, but it does not override a failed protected required context.

Merge boundary

Merge only when this unchanged exact head has every then-live protected repository/organization required context terminal-success, zero valid unresolved findings/threads, and qualifying post-last-push independent approval. Failed, queued, pending, skipped-required, absent, stale, predecessor, status-only, or author-side evidence is non-passing.

No force-push, destructive rebase, self-approval, dummy/no-op requeue commit, review fabrication/dismissal, central authorization widening from Naruon, synthetic status, or gate weakening.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 91c5c8c9-ec47-4554-9eb3-af733d3a355a

📥 Commits

Reviewing files that changed from the base of the PR and between 042b0c7 and b2ee42b.

📒 Files selected for processing (3)

• .github/workflows/docker-publish.yml
• backend/tests/test_docker_workflow_concurrency.py
• backend/tests/test_release_governance.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Docker publish workflow adds event-aware concurrency groups. First-attempt pull request runs can cancel older runs, while reruns and tag publications use independent groups. Two tests verify the workflow configuration.

Changes

Docker publish concurrency

Layer / File(s)	Summary
Concurrency policy and regression coverage .github/workflows/docker-publish.yml, backend/tests/test_docker_workflow_concurrency.py, backend/tests/test_release_governance.py	The workflow assigns first-attempt pull request runs to a shared group and uses unique run IDs for reruns and tag runs. Cancellation applies only to pull request events. Tests verify these expressions and prevent unconditional cancellation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b2ee4

Docker PR validations now cancel superseded first attempts without interrupting manual reruns, while tag image publication remains non-cancellable. The intended behavior is covered by regression tests, with no active merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: coalescing superseded Docker pull request image validation runs.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/docker-publish-pr-concurrency

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Current exact head: b2ee42b6e9286aac4b908a644f472c71d9ccc2a6. Repository-owned Application CI, Bandit, Security, Semgrep, and all three Docker PR image validations are terminal-success on this unchanged head. Please review the exact protected-base delta (develop@042b0c70531b229af3acbd0421a2f23098d848b3 → b2ee42b6...), especially the first-attempt vs manual-rerun concurrency-generation contract. CodeQL remains a separate fail-closed canonical .github control-plane blocker and is not being waived here.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='042b0c70531b229af3acbd0421a2f23098d848b3'
head='b2ee42b6e9286aac4b908a644f472c71d9ccc2a6'

echo '== Exact changed files =='
git diff --name-status "$base" "$head"

echo '== Exact patch =='
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
  .github/workflows/docker-publish.yml \
  backend/tests/test_docker_workflow_concurrency.py \
  backend/tests/test_release_governance.py

echo '== Workflow outline =='
ast-grep outline .github/workflows/docker-publish.yml --items all || true

echo '== Workflow contents =='
cat -n .github/workflows/docker-publish.yml

echo '== Relevant test definitions and context =='
rg -n -C 12 \
  'test_docker_pr_concurrency_isolates_reruns_from_first_attempts|test_docker_publish_validates_pr_images_and_publishes_semver_images_only_on_tags|docker-publish|concurrency|run_attempt|cancel-in-progress' \
  backend/tests/test_docker_workflow_concurrency.py \
  backend/tests/test_release_governance.py

Length of output: 53744

---

@seonghobae Reviewed the exact protected-base delta through b2ee42b6e9286aac4b908a644f472c71d9ccc2a6.

I found no review findings.

The workflow group separates first-attempt PR runs from manual reruns. First attempts for the same repository and pull request use first-attempt. Manual reruns use the stable github.run_id. Therefore, a newer first-attempt PR event does not cancel an older manual rerun.

Tag pushes include github.run_id and use cancel-in-progress: false. This preserves non-cancellable tag publication. The new regression test checks the complete generation expression and the event-scoped cancellation setting.

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

승계 검증 결과: #1600의 02dd5747ba4bf110a2a148deb532442ce5eb0694는 동시 실행 변경을 이 canonical lane으로 돌리기 위해 제거했습니다. 현재 #1592 b2ee42b6e9286aac4b908a644f472c71d9ccc2a6의 실제 diff와 비교하면 PR first-attempt 취소와 의도적 rerun 격리는 구현되어 있으나, a10d180384133217ec5891802772ea5ac9233ead의 release destination 직렬화 및 pending 보존 계약은 아직 승계되지 않았습니다. 현재 tag group은 ref/run_id별로 달라 동일 GHCR/AKS 대상의 여러 release가 병렬 실행될 수 있습니다. 승인된 기존 head를 덮어쓰지 않고 후속 canonical 수정에서 이 차이를 해결해야 합니다. Native queue max는 pending 100개 한도이며 actionlint 1.7.12는 해당 키를 지원하지 않습니다. 따라서 lint 예외, unmerged 도구 채택 또는 단순 queue 생략으로 완료 처리하지 않습니다. 기존 PR rerun 의도 보존은 별도로 유지·검증해야 합니다. #1600의 이전 group admission 증거는 현재 #1592 실행 증거로 전용할 수 없습니다. 이 댓글은 병합 승인이나 배포 성공 증거가 아닙니다.

[seonghobae]

누락된 release 직렬화·pending 보존의 실행 가능한 후속 수리는 #1605@174746e2f72fcd684d29c3260d36e9ad26634159에 올렸습니다. 이 PR의 b2ee 승인 head는 변경하지 않았고, 기존 수동 rerun 격리를 유지합니다. main 독립 37 tests 및 공식 expression evaluator 통과. actionlint queue 미지원은 미해결로 공개했으며 우회하지 않았습니다. #1605는 이 브랜치를 base로 한 Draft이고, #1600에 중복 복원하지 않습니다.

[seonghobae]

Current-head evidence

• exact head: b2ee42b6e9286aac4b908a644f472c71d9ccc2a6
• PR is non-Draft and APPROVED, but merge state is BLOCKED
• CodeQL compatibility actions/javascript-typescript/python are failed
• CodeQL PR run 34157349575 is visible for this exact head, but the failed-log endpoint returns GitHub API 404; no failure phrase or annotation can be safely attributed
• Dynamic CodeQL quality/scanning runs, Bandit, Security Scan, and Strix are successful, but they do not replace the failed compatibility gate

Keep the gate blocked until authenticated exact-head compatibility evidence is available. No blind rerun, gate weakening, review dismissal, or bypass.

[seonghobae]

#1621 has been repaired into a Draft descendant of this exact owner head b2ee42b6e9286aac4b908a644f472c71d9ccc2a6 rather than remaining a competing Docker-concurrency writer.

Current #1621 head: 12d8cac36562b27c9f23e10eb4e75fbf6535e9be.

Effective delta against #1592 is now exactly two files: .github/workflows/docker-publish.yml and backend/tests/test_docker_workflow_concurrency.py. It preserves this PR's workflow-level first-attempt/manual-rerun generation contract unchanged and adds only release-publication serialization: repository + tag ref + matrix.component, queue: max, cancel-in-progress: false.

The queue: max addition is required by the current GitHub concurrency contract: cancel-in-progress: false alone still uses default queue: single, so a third same-group request can replace an existing pending publication. The focused #1621 regression pins the bounded multi-pending behavior without claiming unlimited retention or dispatch-order FIFO.

#1621 remains Draft and must not merge ahead of this prerequisite. After #1592 normally integrates, restack/retarget #1621 and regenerate exact-head checks/review; no predecessor evidence transfers.