[goosewobbler]

Description

Ports webdriverio/desktop-mobile#765 to releasekit's own CI, which also runs standing-PR mode on release/next.

Job guards. In codeql.yml, pr-title.yml and release-preview.yml, the job now skips when the PR comes from this repo's own release/next:

if: ${{ github.head_ref != 'release/next' || github.event.pull_request.head.repo.full_name != github.repository }}

The standing PR's diff is only version bumps and changelogs, so none of these checks can find anything there:

• CodeQL would re-analyse code that main has already scanned.
• Release Preview does a full-history checkout, pnpm install and pnpm build of every package before cli.js preview notices that the head is ci.standingPr.branch and skips. It runs on every label change on the standing PR, and those come from humans, so they run straight away.
• PR Title (pull_request_target) runs on every edit of the standing PR (e.g. 12 runs triggered by greptile), but releasekit writes that title.

On push and schedule events github.head_ref is empty, so main and the weekly CodeQL scan still run. The repo check stops a fork from skipping these checks with a branch of the same name.

CodeQL concurrency. CodeQL now has ${{ github.workflow }}-${{ github.ref }} with cancel-in-progress: true, so a newer push to a PR or to main cancels the superseded analysis, as ci.yml already does. A cancelled run on main loses nothing: the newer run scans the latest code. On 2026-10-22, two merges a minute apart each ran a full analysis.

Checked while adapting

• Required checks: none. main has no branch protection and no rulesets, so the standing PR's mergeability doesn't change. If a check were made required later, a skipped job reports as success, so the standing PR could still merge — that's why the guard sits on the job, not the trigger (pull_request can't filter on the head branch anyway).
• One exception: the title action also posts an action-semantic-pull-request commit status (wip: true). The standing PR doesn't get that status today either (bot pushes don't trigger pull_request_target), but if that context is ever made required it needs an exception for release/next.
• Dependents: no workflow uses workflow_run on any of these three; releasekit's preview posts its own comment, so desktop-mobile's preview-comment workflow has no counterpart.
• Hardcoded branch: per AGENTS.md, workflow if guards can't read releasekit.config.json, so the guard hardcodes the default release/next. The comments refer to it as ci.standingPr.branch rather than by name. The CLI's in-step check stays authoritative.
• Approvals: standing-PR pushes use GITHUB_TOKEN, so the pull_request runs they create wait for approval (action_required). The guards don't change that; approved runs just skip instead of analysing and building.

Not carried over: the consumer template templates/workflows/release-preview.yml is unchanged. It's user-facing and examples-smoke generates its workflow from it; whether it should ship the same guard is a separate decision.

Related Issue(s)

Port of webdriverio/desktop-mobile#765. While checking this PR's release preview, found #683.

Type of Change

• feat — New feature
• fix — Bug fix
• docs — Documentation change
• refactor — Code refactoring
• test — Adding or updating tests
• chore — Maintenance, dependencies, tooling
• Breaking change — Requires major version bump

Scope

• @releasekit/version
• @releasekit/notes
• @releasekit/publish
• @releasekit/config
• @releasekit/core
• CI / workflows
• Root / monorepo

Checklist

• Lint passes (pnpm lint)
• Tests pass (pnpm test) — YAML only
• Typecheck passes (pnpm typecheck) — YAML only
• Documentation updated (if applicable)
• Breaking changes noted in description

Testing Notes

• actionlint is clean on all three changed workflows; all three load with yaml.safe_load.

• Guard behaviour, by case:

  Event	Result
  push	runs
  schedule	runs
  Feature-branch PR	runs
  Same-repo release/next PR	skipped
  Fork release/next PR	runs

  github.head_ref and github.event.pull_request.head.repo are both set for pull_request and pull_request_target.

• To confirm on GitHub after merge: the next standing-PR update should show these three jobs as skipped once its runs are approved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HQN3v9Z4f1mu3xK4Z7K44e

[github-actions]

Standing release PR: #614 · v0.42.0 queued (4 packages) · open 82d 2h 2m · ✅ ready to merge

Release Preview — v0.41.2 → v0.41.3

Note: Labels on this PR are advisory in standing-pr mode. Bumps come from conventional commits in the standing PR; override by editing labels on the standing PR itself. Add release:immediate to bypass the standing PR and release this PR directly.

These changes will be added to the release PR (#614) when merged:

Changelog

monorepo 0.41.2 → 0.41.3

Changed

• don't name the branch in the guard comment (codeql)
• Revert "ci: fail when a workflow guard's branch drifts from ci.standingPr.branch"
• fail when a workflow guard's branch drifts from ci.standingPr.branch
• say what the repo check in the standing-PR guard prevents (codeql)
• skip CodeQL, release preview and title checks on the standing release PR

All packages → 0.41.3 (sync versioning)

• @releasekit/version
• @releasekit/notes
• @releasekit/publish
• @releasekit/release

After merge — predicted release

No version escalation — this PR's changes will be included in the queued release without affecting the projected versions.

Package	Standing PR	This PR	After merge
monorepo	0.42.0	0.41.3	0.42.0

---

Updated automatically by ReleaseKit