[d-morrison]

Ezra's standing rule (2026-11-02): "always cancel stale runs". On Ezra's decision (2026-11-03) to roll this out to every Morrison-Lab repo with PR CI, this adds a 17-line caller for Morrison-Lab/gha's cancel-superseded.yml (gha#1400, gha#1401, on v3). On every synchronize and closed of a pull request it cancels that PR's queued and running runs for any head other than the current one, and every earlier run of a closed PR. Runs not tied to a PR (push to main) are not covered. Not exercised before merge: the first live run is this PR's own next push or close.

---

Generated by Claude Code

[github-actions]

Claude finished review — View run

---

Review: Morrison-Lab/qbt PR #104 — Add cancel-superseded caller

Change: Adds .github/workflows/cancel-superseded.yml, a 13-line caller that invokes Morrison-Lab/gha's reusable cancel-superseded.yml@v3 workflow on pull_request: [synchronize, closed], granting actions: write and pull-requests: read.

Verification performed

• Fetched Morrison-Lab/gha at tag v3 directly (raw.githubusercontent.com/Morrison-Lab/gha/v3/...) to confirm the referenced reusable workflow exists, matches the described behavior (cancels queued/running runs for superseded heads on synchronize, and pre-close runs on closed), and requires exactly actions: write + pull-requests: read — the caller grants precisely that, no more, no less.
• Checked the sibling check-caller-permissions reusable action/script description: it explicitly accepts permissions granted at either the job level or the workflow-level block, so this caller's top-level permissions: block (rather than job-level, as used by lint-workflows.yml, check-caller-permissions.yml, cleanup-pr-previews.yml in this repo) will still pass that audit — not a real deviation, just a different valid placement of the same grant.
• Confirmed via yaml.safe_load the file parses without syntax errors (the on: → True key coercion is a standard PyYAML 1.1 quirk present in every workflow in this repo and harmless to GitHub's own parser).
• Confirmed no pre-existing cancel-superseded-style workflow already exists in this repo, and no conflicting concurrency: group names (the reusable workflow scopes its own concurrency group by PR number internally, independent of this caller).
• Confirmed the PR is open, not a draft, mergeable, and has no prior comments (including none from Claude) to reconcile against.
• gha#1400 checks out against the fetched reusable workflow's own code comment; gha#1401 is plausible as the paired rollout-tracking issue and isn't independently verifiable from this repo, but nothing in the PR body is contradicted by what I could fetch.

Findings

None. This is a minimal, correctly-scoped reusable-workflow caller consistent with this repo's existing patterns (lint-workflows.yml, check-caller-permissions.yml, cleanup-pr-previews.yml), grants least-privilege permissions matching the callee's exact requirements, and is not R/Quarto content so the lab manual's coding-style/coding-practices sections don't apply — the relevant "Code repositories" conventions (thin, pinned reusable-workflow callers) are followed.

Verdict

Ready for merge

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "cf755b74320ad64be91019e4def7505b573ec39f",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "No defects found in .github/workflows/cancel-superseded.yml after confirming against the fetched Morrison-Lab/gha v3 reusable workflow that permissions, trigger types, and job wiring match exactly.",
  "holistic_assessment": "Scope is a single thin caller consistent with existing repo conventions, grants least-privilege permissions matching the callee, and introduces no regression risk to publish or preview pipelines."
}

Reviewed commit: cf755b7

[github-actions]

💰 Cost: $0.3093 (review) — run

[github-actions]

PR Preview Action v1.8.2
Preview removed because the pull request was closed.

_{2026-11-05 07:19 UTC}