[d-morrison]

Ezra's standing rule (2026-11-02): "always cancel stale runs". On Ezra's decision (2026-11-03) to roll this out to every Morrison-Lab repo with PR CI, this adds a 17-line caller for Morrison-Lab/gha's cancel-superseded.yml (gha#1400, gha#1401, on v3). On every synchronize and closed of a pull request it cancels that PR's queued and running runs for any head other than the current one, and every earlier run of a closed PR. Runs not tied to a PR (push to main) are not covered. Not exercised before merge: the first live run is this PR's own next push or close.

---

Generated by Claude Code

[github-actions]

Claude finished review — View run

---

Review: Add cancel-superseded caller (#203)

Summary. Single-file, 13-line addition: .github/workflows/cancel-superseded.yml, a thin caller of Morrison-Lab/gha's reusable cancel-superseded.yml@v3 workflow, triggered on pull_request: synchronize, closed. Rolls out Ezra's "always cancel stale runs" rule to this repo per the lab's cross-project policy ([[cancel-superseded]]-style systemic fix, consistent with AGENTS.md's "Terminate superseded and abandoned background tasks"). PR is open, not a draft, mergeable, and has no prior Claude comments.

Verification performed:

• Confirmed Morrison-Lab/gha tag v3 exists and .github/workflows/cancel-superseded.yml at that ref is a real reusable workflow (not a hallucinated reference) — fetched it directly.
• Confirmed the reusable workflow's job-level permissions: {actions: write, pull-requests: read} matches exactly what this caller grants at the workflow level — no permission mismatch.
• YAML parses cleanly (validated with python3 -c "import yaml...").
• Cross-checked against every other Morrison-Lab/gha caller already in this repo (preview.yml, publish.yml, claude.yml, preview-deploy.yml, check-junk-files.yml, lint-workflows.yml, etc.) — version pinning is mixed (v2/v3) per-workflow already, so @v3 here is not an inconsistency.
• No existing workflow in this repo already does cross-workflow stale-run cancellation (the concurrency:/cancel-in-progress blocks in preview.yml, publish.yml, etc. only dedupe within their own workflow+group), so this isn't a redundant addition.

Finding (non-blocking style nit):

• .github/workflows/cancel-superseded.yml:13 — permissions: is declared at the top (workflow) level rather than scoped to the cancel job. Every other reusable-workflow caller in this repo (preview.yml:34, publish.yml:21, check-junk-files.yml:13, lint-workflows.yml:29-31, etc.) scopes permissions: under the job instead, and lint-workflows.yml even comments why: "The repo default is write, so declare the read-only scope this reusable workflow's own job asks for rather than inheriting it." Functionally this file is equivalent (single job, same effective permissions), so it isn't a bug — but it breaks the established convention this repo otherwise applies consistently. Worth moving permissions: under jobs: cancel: for consistency, but not blocking.

No bugs, no CLAUDE.md violations that are blocking, no hallucinated APIs/refs, no scope creep (single focused file, matches PR description), and no build-hygiene issues (_site//_freeze/ untouched). This isn't .qmd/R content, so the Quarto/prose/lint checks in the review brief don't apply here.

Verdict

Ready for merge

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "966499812ed26561cf1d1be17a5c4da10c012d79",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "Checked .github/workflows/cancel-superseded.yml for YAML validity, correct permissions matching the Morrison-Lab/gha v3 reusable workflow, and found no failure mode in the trigger or uses clause.",
  "holistic_assessment": "Scope is a single focused caller file matching the PR description, no regression risk to publish or preview pipelines, and no validation gaps since the reusable workflow and tag were fetched and confirmed real."
}

Reviewed commit: 9664998

[github-actions]

💰 Cost: $0.3428 (review) — run

[Copilot]

🔵 Needs a closer look

Repository-wide workflow cancellation has not been exercised on a live PR, leaving synchronize/closed behavior and preservation of close-time cleanup unverified.

No open issues 🎉

What changed in this PR

Adds a caller to the shared cancellation workflow so PR CI can cancel stale runs after updates or closure.

Changes:

• Triggers on pull request synchronize and closed events.
• Grants Actions write and pull request read permissions.
• Delegates cancellation to Morrison-Lab/gha’s reusable workflow at v3.

File	Description
.github/​workflows/​cancel-superseded.yml	Adds the event triggers, permissions, and shared workflow call for cancelling superseded PR runs.

_{Review effort: Balanced}

[github-actions]

Claude finished review — View run

---

YAML parses cleanly (the on: key parses as the boolean True under PyYAML's legacy YAML 1.1 behavior — a well-known PyYAML quirk, not a bug in the file itself; GitHub Actions' own YAML parser handles on: as a literal key correctly).

Review: Add cancel-superseded caller (#203)

What changed since the last round. Nothing in content. The only new commit, 09732f9, is a merge commit bringing the PR branch (966499812ed26561cf1d1be17a5c4da10c012d79) up to date with main (f1d66084f5e10fa111aa0b0099f0af87992429c5). git diff --stat 96649981 09732f94 is empty, and the saved PR diff still shows the same single-file, 13-line addition of .github/workflows/cancel-superseded.yml reviewed previously.

The prior review (comment linked below) is still accurate:

Prior review — Ready for merge, with one non-blocking style nit: permissions: is declared at the workflow level rather than scoped under jobs: cancel:, inconsistent with this repo's other Morrison-Lab/gha callers (preview.yml, publish.yml, check-junk-files.yml, lint-workflows.yml), though functionally equivalent for this single-job workflow.

That nit is still present and still non-blocking — nothing changed on that line.

No new bugs, no new CLAUDE.md violations, no hallucinated references (the Morrison-Lab/gha@v3 reusable workflow was already confirmed to exist in the prior round, and nothing in this merge commit touches that reference), and no scope creep. Build hygiene is unaffected (_site//_freeze/ untouched). This is not .qmd/R content, so the Quarto/prose/lint/lab-manual checks don't apply.

Verdict

Ready for merge

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "09732f947cf3ffa221b66a6a6c39f7c3d3609358",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "Re-checked .github/workflows/cancel-superseded.yml content via the saved diff; the merge commit introduces no file changes, only a merge from main into the PR branch.",
  "holistic_assessment": "Scope remains a single focused caller file matching the PR description; no new integration, regression, or validation concerns since the prior clean verdict."
}

Reviewed commit: 9664998

[github-actions]

💰 Cost: $0.1765 (review) — run