ci: batch trunk-PR CI on the merge train's ci:run label

.github/workflows/codegen-models.yml

@@ -6,12 +6,25 @@ on:
       - 'packages/utils/cli-registry.yaml'
     branches: [main]
   pull_request:
+    # Trunk -> main promotion PR only, and only on purpose: CI runs when the
+    # `ci:run` label is added (by the merge train, or an agent once the PR is
+    # ready). Opened, reopened and synchronize run nothing; any other label
+    # skips every job.
+    types: [labeled]
     paths:
       - 'packages/utils/cli-registry.yaml'
 
+concurrency:
+  # PR runs collapse per pull request; push runs key off the commit sha so two
+  # merges landing together cannot cancel each other. A `labeled` event for any
+  # label other than `ci:run` runs nothing, so it gets its own throwaway group:
+  # it must never cancel the PR's in-progress run.
+  group: codegen-models-${{ github.event_name == 'push' && format('push-{0}', github.sha) || github.event_name != 'pull_request' && format('run-{0}', github.run_id) || ((github.event.action == 'labeled' && github.event.label.name != 'ci:run') && format('ignored-{0}', github.run_id) || format('pr-{0}', github.event.pull_request.number)) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   codegen:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/e2e-tests.yml

@@ -13,6 +13,11 @@ on:
       - 'package.json'
       - '.github/workflows/e2e-tests.yml'
   pull_request:
+    # Trunk -> main promotion PR only, and only on purpose: CI runs when the
+    # `ci:run` label is added (by the merge train, or an agent once the PR is
+    # ready). Opened, reopened and synchronize run nothing; any other label
+    # skips every job.
+    types: [labeled]
     branches: [main]
     paths:
       - 'packages/**'
@@ -27,15 +32,19 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # PR runs collapse per pull request; push runs key off the commit sha so two
+  # merges landing together cannot cancel each other. A `labeled` event for any
+  # label other than `ci:run` runs nothing, so it gets its own throwaway group:
+  # it must never cancel the PR's in-progress run.
+  group: e2e-tests-${{ github.event_name == 'push' && format('push-{0}', github.sha) || github.event_name != 'pull_request' && format('run-{0}', github.run_id) || ((github.event.action == 'labeled' && github.event.label.name != 'ci:run') && format('ignored-{0}', github.run_id) || format('pr-{0}', github.event.pull_request.number)) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   AGENT_RELAY_TELEMETRY_DISABLED: 1
 
 jobs:
   e2e-test:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')
     name: E2E Integration Test
     runs-on: ${{ matrix.os }}
     strategy:

.github/workflows/fleet-e2e.yml

@@ -27,6 +27,11 @@ on:
       - 'vitest.e2e.config.ts'
       - '.github/workflows/fleet-e2e.yml'
   pull_request:
+    # Trunk -> main promotion PR only, and only on purpose: CI runs when the
+    # `ci:run` label is added (by the merge train, or an agent once the PR is
+    # ready). Opened, reopened and synchronize run nothing; any other label
+    # skips every job.
+    types: [labeled]
     branches: [main, 'feat/fleet-**']
     paths:
       - 'packages/fleet/**'
@@ -45,15 +50,19 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # PR runs collapse per pull request; push runs key off the commit sha so two
+  # merges landing together cannot cancel each other. A `labeled` event for any
+  # label other than `ci:run` runs nothing, so it gets its own throwaway group:
+  # it must never cancel the PR's in-progress run.
+  group: fleet-e2e-${{ github.event_name == 'push' && format('push-{0}', github.sha) || github.event_name != 'pull_request' && format('run-{0}', github.run_id) || ((github.event.action == 'labeled' && github.event.label.name != 'ci:run') && format('ignored-{0}', github.run_id) || format('pr-{0}', github.event.pull_request.number)) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   AGENT_RELAY_TELEMETRY_DISABLED: 1
 
 jobs:
   fleet-e2e:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')
     name: Two-node fleet matrix
     runs-on: ubuntu-latest
     timeout-minutes: 20

.github/workflows/large-files.yml

@@ -1,8 +1,14 @@
 name: Large File Check
-on: [pull_request]
+on:
+  pull_request:
+    # Trunk -> main promotion PR only, and only on purpose: CI runs when the
+    # `ci:run` label is added (by the merge train, or an agent once the PR is
+    # ready). Opened, reopened and synchronize run nothing; any other label
+    # skips every job.
+    types: [labeled]
 jobs:
   check:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/merge-train-ready.yml

@@ -0,0 +1,66 @@
+name: Merge-train ready check
+
+# Lightweight gate for feature PRs into `trunk` (full CI runs only on the
+# trunk -> main promotion PR). It runs once the author adds the `mergeable`
+# label, and again on every push while the label is on. The merge-train sweeper
+# (AgentWorkforce/cloud packages/web/lib/merge-train) merges a feature PR into
+# trunk only when this check is green on the PR's CURRENT head.
+#
+# Fork PRs run it too. `pull_request` gives a fork no secrets and a read-only
+# token, and nothing here uses a secret or persists credentials. Never switch
+# this to `pull_request_target`. Trust is the sweeper's job: it merges an
+# external PR only after a maintainer's APPROVED review on its exact head.
+#
+# A labelled PR with no run for its head (labelled before this workflow
+# existed, or retargeted onto trunk, which emits `edited`) is kicked by the
+# sweeper re-adding the `ready:check` label: any label event runs this job while
+# `mergeable` is on. `edited` is deliberately not a trigger, since body edits
+# would re-run it constantly.
+on:
+  pull_request:
+    branches: [trunk]
+    types: [labeled, synchronize, reopened]
+
+concurrency:
+  # One run per PR: a newer push or label event supersedes the in-flight run.
+  # An event the job will skip (`mergeable` absent) gets a throwaway group, so
+  # it can never cancel a real run and leave `cancelled` as the head's verdict.
+  group: merge-train-ready-${{ contains(github.event.pull_request.labels.*.name, 'mergeable') && format('pr-{0}', github.event.pull_request.number) || format('ignored-{0}', github.run_id) }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  ready:
+    # The sweeper reads this exact check name (cloud lib/merge-train/config.ts).
+    name: Merge-train ready check
+    # Any label event re-runs it while `mergeable` is present (not just the
+    # `mergeable` event): a skipped run would otherwise become the latest check
+    # for the head and mask the real verdict.
+    if: >-
+      github.base_ref == 'trunk' &&
+      contains(github.event.pull_request.labels.*.name, 'mergeable')
+    # Fork PRs run here, so never the self-hosted CI_LINUX_RUNNER pool.
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.14.0
+          cache: 'npm'
+      - run: npm ci
+      - name: Ensure rollup optional dependencies are installed
+        run: npm install --no-save rollup || true
+      - name: Merge-train workflow contract
+        run: node --test scripts/merge-train-ci-workflows.test.mjs
+      - name: Lint
+        run: npm run lint
+      - name: Check formatting
+        run: npm run format:check
+      - name: Typecheck
+        run: npm run typecheck

.github/workflows/node-compat.yml

@@ -4,6 +4,11 @@ on:
   push:
     branches: [main]
   pull_request:
+    # Trunk -> main promotion PR only, and only on purpose: CI runs when the
+    # `ci:run` label is added (by the merge train, or an agent once the PR is
+    # ready). Opened, reopened and synchronize run nothing; any other label
+    # skips every job.
+    types: [labeled]
     branches: [main]
 
 # Reusable workflows cannot elevate the caller's token permissions.
@@ -13,18 +18,22 @@ permissions:
   pull-requests: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # PR runs collapse per pull request; push runs key off the commit sha so two
+  # merges landing together cannot cancel each other. A `labeled` event for any
+  # label other than `ci:run` runs nothing, so it gets its own throwaway group:
+  # it must never cancel the PR's in-progress run.
+  group: node-compat-${{ github.event_name == 'push' && format('push-{0}', github.sha) || github.event_name != 'pull_request' && format('run-{0}', github.run_id) || ((github.event.action == 'labeled' && github.event.label.name != 'ci:run') && format('ignored-{0}', github.run_id) || format('pr-{0}', github.event.pull_request.number)) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   changes:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')
     uses: ./.github/workflows/detect-changes.yml
   install-test:
     name: Install Test (Node ${{ matrix.node-version }})
     needs: changes
     if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')) &&
       (needs.changes.outputs.node_changed == 'true')
     runs-on: ubuntu-latest
     strategy:
@@ -87,7 +96,7 @@ jobs:
     name: Fresh Install (Node ${{ matrix.node-version }})
     needs: changes
     if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')) &&
       (needs.changes.outputs.node_changed == 'true')
     runs-on: ubuntu-latest
     strategy:

.github/workflows/package-validation.yml

@@ -4,6 +4,11 @@ on:
   push:
     branches: [main]
   pull_request:
+    # Trunk -> main promotion PR only, and only on purpose: CI runs when the
+    # `ci:run` label is added (by the merge train, or an agent once the PR is
+    # ready). Opened, reopened and synchronize run nothing; any other label
+    # skips every job.
+    types: [labeled]
     branches: [main]
 
 # Reusable workflows cannot elevate the caller's token permissions.
@@ -13,21 +18,25 @@ permissions:
   pull-requests: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # PR runs collapse per pull request; push runs key off the commit sha so two
+  # merges landing together cannot cancel each other. A `labeled` event for any
+  # label other than `ci:run` runs nothing, so it gets its own throwaway group:
+  # it must never cancel the PR's in-progress run.
+  group: package-validation-${{ github.event_name == 'push' && format('push-{0}', github.sha) || github.event_name != 'pull_request' && format('run-{0}', github.run_id) || ((github.event.action == 'labeled' && github.event.label.name != 'ci:run') && format('ignored-{0}', github.run_id) || format('pr-{0}', github.event.pull_request.number)) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   AGENT_RELAY_TELEMETRY_DISABLED: 1
 
 jobs:
   changes:
-    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')
     uses: ./.github/workflows/detect-changes.yml
   validate:
     name: Build & Validate
     needs: changes
     if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')) &&
       (needs.changes.outputs.node_changed == 'true')
     runs-on: ubuntu-latest
     env:
@@ -203,7 +212,7 @@ jobs:
     name: Publish Fresh Install Build
     needs: changes
     if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')) &&
       (needs.changes.outputs.node_changed == 'true')
     runs-on: ubuntu-latest
     env:
@@ -253,7 +262,7 @@ jobs:
     # provisioning an undeletable workspace; other same-repository PRs and
     # main pushes must reuse the CI workspace.
     if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')) &&
       (needs.changes.outputs.node_changed == 'true' && github.actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository))
     runs-on: macos-latest
     env:

.github/workflows/prettier-fmt-fix.yml

@@ -18,6 +18,11 @@ on:
       - '**.yaml'
       - '**.yml'
   pull_request:
+    # Trunk -> main promotion PR only, and only on purpose: CI runs when the
+    # `ci:run` label is added (by the merge train, or an agent once the PR is
+    # ready). Opened, reopened and synchronize run nothing; any other label
+    # skips every job.
+    types: [labeled]
     paths:
       - '**.css'
       - '**.html'
@@ -33,13 +38,21 @@ on:
       - '**.yaml'
       - '**.yml'
 
+concurrency:
+  # PR runs collapse per pull request; push runs key off the commit sha so two
+  # merges landing together cannot cancel each other. A `labeled` event for any
+  # label other than `ci:run` runs nothing, so it gets its own throwaway group:
+  # it must never cancel the PR's in-progress run.
+  group: prettier-fmt-fix-${{ github.event_name == 'push' && format('push-{0}', github.sha) || github.event_name != 'pull_request' && format('run-{0}', github.run_id) || ((github.event.action == 'labeled' && github.event.label.name != 'ci:run') && format('ignored-{0}', github.run_id) || format('pr-{0}', github.event.pull_request.number)) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   format:
     name: Auto-format Prettier files
     runs-on: ubuntu-latest
     # Only run on same-repo PRs where the bot can push back formatting commits.
     if: >-
-      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) &&
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main' && github.event.action == 'labeled' && github.event.label.name == 'ci:run')) &&
       (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
     permissions:
       contents: write