[polaz]

Summary

Run feature CI once per pull request, retain main-push validation and supersede
obsolete PR runs. Check documentation links at the start of the Linux contract
job and run the existing CodeQL language matrix one job at a time.

Preserve the full Linux/browser suite, native macOS/Windows checks, CodeQL query
coverage and analysis categories. Pin Actions by commit, keep Rust on stable and
disable unused checkout credential persistence. Dependabot admission is unchanged.

Validation

actionlint, workflow security auditing and documentation link checks pass.
Configuration comparisons verify that the build/test commands, native matrix,
documentation arguments and CodeQL language/category settings are retained.
GitHub Actions provides live workflow qualification.

Landing

Based on the setup merged in #27. Documentation is enforced inside the required
Linux contract job; the redundant standalone required status is retired.
All other required checks retain their names and coverage.

Closes #28

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T14:20:46.220185Z	7664b9d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

📝 Summary

Summary by CodeRabbit

• Chores
  • Automated checks now run for pushes to the main branch and pull requests. When a new pull request run starts, any in-progress run for the same workflow and branch is canceled.
  • Documentation link checks run offline, and the separate documentation workflow has been removed.
  • Automated checks use pinned tool versions and avoid saving checkout credentials. Parallel CodeQL matrix jobs are limited to one at a time.

The CI workflow restricts push runs to main, adds run concurrency controls, moves documentation link checking into the contracts job, and pins actions. The CodeQL workflow adds concurrency controls and runs at most one matrix job at a time.

Changes: CI workflow updates

Layer / File(s)	Summary
CI triggers and contract validation .github/workflows/ci.yml	Push runs are restricted to main, and workflow/ref concurrency is added. The contracts job pins its actions and runs an offline documentation link check. The separate documentation job is removed.
Native-observation action pinning .github/workflows/ci.yml	The native-observation job pins its checkout and Rust toolchain actions. Checkout credential persistence is disabled.
CodeQL concurrency .github/workflows/codeql.yml	The workflow adds workflow/ref concurrency with pull-request-only cancellation. The analysis matrix runs at most one job in parallel.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related PRs

• structured-world/omloom#27: Introduces the CodeQL workflow whose concurrency and matrix settings change here.
• structured-world/omloom#25: Adds the native-observation job whose action configuration changes here.
• structured-world/omloom#12: Updates the contracts job with documentation link-check inputs; this PR moves that check into the contracts job.

Merge Risk: Low · up to 7664b

The workflow changes are mergeable with coordinated required-check migration: verify documentation validation in the contracts job and retire the standalone Documentation requirement at landing to avoid blocking subsequent pull requests.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "ci: reduce duplicate runs and runner contention" matches the main change. The workflow edits limit push runs to main, add per-workflow/ref concurrency groups, cancel superseded PR runs, and…
Linked Issues check		Issue [#28] coding requirements are met. .github/workflows/ci.yml runs on pull_request and main pushes only, uses separate ref-based concurrency, and cancels only pull-request runs. The contract…
Out of Scope Changes check		The reviewed changes are limited to .github/workflows/ci.yml and .github/workflows/codeql.yml. The event filters, concurrency controls, documentation-check placement, Action pins, checkout credent…
Description check		The pull request description directly describes the workflow changes, including CI concurrency, documentation checks, CodeQL execution, action pinning, and credential handling.

Full details: Title check

Explanation

The title "ci: reduce duplicate runs and runner contention" matches the main change. The workflow edits limit push runs to main, add per-workflow/ref concurrency groups, cancel superseded PR runs, and limit the CodeQL matrix to one parallel job. The title is specific and concise.

Full details: Linked Issues check

Explanation

Issue [#28] coding requirements are met. .github/workflows/ci.yml runs on pull_request and main pushes only, uses separate ref-based concurrency, and cancels only pull-request runs. The contracts job runs the existing documentation link check before Node, Rust, dependency, Playwright, and contract setup. The native macOS and Windows matrix and existing commands remain. .github/workflows/codeql.yml retains the actions, javascript-typescript, and rust analyses, their matrix-derived names and categories, and sets max-parallel: 1. The workflows pin Actions to commit SHAs, keep Rust on stable, and set persist-credentials: false. The standalone Documentation job is removed after its check is retained in the required contracts job.

Full details: Out of Scope Changes check

Explanation

The reviewed changes are limited to .github/workflows/ci.yml and .github/workflows/codeql.yml. The event filters, concurrency controls, documentation-check placement, Action pins, checkout credential settings, and CodeQL matrix limit directly implement issue [#28]. The retained workflow commands and removed standalone documentation job support the required check migration. No unrelated change is demonstrated.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🔇 Additional comments: 1

.github/workflows/ci.yml-19-20: 1

19-20: Minor · Potential issue · Quick win

⚠️ Unverified finding
We couldn't verify this from the code. It is shown for review, not as a verified issue.

Moving documentation validation into contracts removes the separate Documentation check. Branch protection may still require the old check rather than the contracts job's check.

GitHub leaves the old required Documentation check pending, blocking the pull request from merging despite successful documentation validation.

This can occur when: A pull request passes all jobs after this workflow is deployed, before the repository's required checks are updated.

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5b46e828-257f-4c66-9d15-b29b3185df61

Commits

Reviewing files that changed from the base of the PR and between 4b0fabb and 7664b9d.

Files selected for processing: 2

• .github/workflows/ci.yml
• .github/workflows/codeql.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.