ci: main-only workflow triggers, cancel-in-progress everywhere

.github/workflows/auto-format.yml

@@ -31,7 +31,7 @@ permissions:
 # mid-commit.
 concurrency:
   group: auto-format-main
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 jobs:
   treefmt:

.github/workflows/branch-cleanup.yml

@@ -22,7 +22,7 @@ permissions:
 
 concurrency:
   group: branch-cleanup
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 jobs:
   cleanup:

.github/workflows/cf-container-hello.yml

@@ -22,11 +22,6 @@ name: cf-container-hello
 # step.
 
 on:
-  pull_request:
-    paths:
-      - "pkgs/cf-container-hello/**"
-      - "pkgs/lab-ops-hub/container/app.py"
-      - ".github/workflows/cf-container-hello.yml"
   push:
     branches: [main]
     paths:

.github/workflows/flake-inputs-update.yml

@@ -45,7 +45,7 @@ permissions:
 
 concurrency:
   group: flake-inputs-update
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 env:
   FAILURE_ISSUE_TITLE: "chore(deps): automated openchamber+opencode input update failing"

.github/workflows/go-modules-build.yml

@@ -29,32 +29,6 @@ name: go modules build
 # pgx/cockroach indirects) with nothing noticing.
 
 on:
-  pull_request:
-    # PR tier (Phase 2, #1781): builds fire on PRs only for class-3
-    # changes (lockfiles, module roots, flake files, build definitions,
-    # workflow files, shared libs); on push to main they always run.
-    paths:
-      - "pkgs/chat/go.mod"
-      - "pkgs/chat/go.sum"
-      - "pkgs/database/go.mod"
-      - "pkgs/database/go.sum"
-      - "pkgs/graph/go.mod"
-      - "pkgs/graph/go.sum"
-      - "pkgs/import/go.mod"
-      - "pkgs/import/go.sum"
-      - "pkgs/launcher/go.mod"
-      - "pkgs/launcher/go.sum"
-      - "pkgs/tea/go.mod"
-      - "pkgs/tea/go.sum"
-      - "pkgs/chat/package.nix"
-      - "pkgs/database/package.nix"
-      - "pkgs/graph/package.nix"
-      - "pkgs/import/package.nix"
-      - "pkgs/launcher/package.nix"
-      - "pkgs/tea/package.nix"
-      - "flake.nix"
-      - "flake.lock"
-      - ".github/workflows/**"
   push:
     branches: [main]
 

.github/workflows/id-check.yml

@@ -50,13 +50,6 @@ on:
       - ".github/scripts/id-pr-checks.txt"
       - ".github/scripts/check-id-pr-checks.sh"
       - ".github/scripts/check-crash-gate-coverage.sh"
-  pull_request:
-    paths:
-      - "pkgs/id/**"
-      - ".github/workflows/id-check.yml"
-      - ".github/scripts/id-pr-checks.txt"
-      - ".github/scripts/check-id-pr-checks.sh"
-      - ".github/scripts/check-crash-gate-coverage.sh"
   schedule:
     # Nightly backstop for the full flake check (main tier, #1781).
     - cron: "41 8 * * *"

.github/workflows/identity-build.yml

@@ -12,17 +12,6 @@ name: identity build
 # vets both variants whenever the module changes.
 
 on:
-  pull_request:
-    # PR tier (Phase 2, #1781): builds fire on PRs only for class-3
-    # changes (lockfiles, module roots, flake files, build definitions,
-    # workflow files, shared libs); on push to main they always run.
-    paths:
-      - "pkgs/identity/go.mod"
-      - "pkgs/identity/go.sum"
-      - "pkgs/identity/package.nix"
-      - "flake.nix"
-      - "flake.lock"
-      - ".github/workflows/**"
   push:
     branches: [main]
 

.github/workflows/jules-daily-codebase-ideation.yml

@@ -20,7 +20,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: true
   queue: max
 
 permissions:

.github/workflows/jules-daily-flake-sync.yml

@@ -22,7 +22,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: true
   queue: max
 
 permissions:

.github/workflows/jules.yml

@@ -47,6 +47,9 @@ on:
 # carries its own group below, keyed by its target, so a run whose jobs all
 # skip can never displace a run that would act.
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 permissions:
   contents: read
   issues: read

.github/workflows/lab-ops-hub.yml

@@ -20,10 +20,6 @@ name: lab-ops-hub
 # deliberately no `npm install` step.
 
 on:
-  pull_request:
-    paths:
-      - "pkgs/lab-ops-hub/**"
-      - ".github/workflows/lab-ops-hub.yml"
   push:
     branches: [main]
     paths:

.github/workflows/main-broken.yml

@@ -70,7 +70,7 @@ permissions:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.workflow_run.id || github.run_id }}
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 jobs:
   watch:

.github/workflows/map-build.yml

@@ -12,17 +12,6 @@ name: map build
 # go-modules-build.yml since that fix landed, so it is not added here.)
 
 on:
-  pull_request:
-    # PR tier (Phase 2, #1781): builds fire on PRs only for class-3
-    # changes (lockfiles, module roots, flake files, build definitions,
-    # workflow files, shared libs); on push to main they always run.
-    paths:
-      - "pkgs/map/go.mod"
-      - "pkgs/map/go.sum"
-      - "pkgs/map/package.nix"
-      - "flake.nix"
-      - "flake.lock"
-      - ".github/workflows/**"
   push:
     branches: [main]
 

.github/workflows/mcpx-conformance.yml

@@ -19,10 +19,6 @@ name: mcpx conformance
 # "Variables: read and write" on this repository, stored as the secret MCPX_CONFORMANCE_VARS_TOKEN.
 
 on:
-  pull_request:
-    paths:
-      - "pkgs/mcpx/**"
-      - ".github/workflows/mcpx-conformance.yml"
   push:
     branches: [main]
     paths:
@@ -36,7 +32,7 @@ permissions:
 # Two runs on main must not read and write the records at the same time.
 concurrency:
   group: mcpx-conformance-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: true
 
 env:
   # Spec revisions one side is expected to have and the other not, as JSON

.github/workflows/mcpx-nixbuild.yml

@@ -18,17 +18,6 @@ name: mcpx nix build
 # changes to this workflow are exercised by it, like mcpx.yml does.
 
 on:
-  pull_request:
-    # PR tier (Phase 2, #1781): builds fire on PRs only for class-3
-    # changes (lockfiles, module roots, flake files, build definitions,
-    # workflow files, shared libs); on push to main they always run.
-    paths:
-      - "pkgs/mcpx/go.mod"
-      - "pkgs/mcpx/go.sum"
-      - "pkgs/mcpx/package.nix"
-      - "flake.nix"
-      - "flake.lock"
-      - ".github/workflows/**"
   push:
     branches: [main]
 

.github/workflows/mcpx.yml

@@ -21,17 +21,6 @@ name: mcpx
 # (#297).
 
 on:
-  pull_request:
-    paths:
-      - "pkgs/mcpx/**"
-      # The dogfood copy of the plugin under .opencode/plugin, so a PR that
-      # only touches it still runs the sync guard below (#314).
-      - ".opencode/plugin/**"
-      - "flake.nix"
-      - "flake.lock"
-      # Itself, so a bot bumping one of the actions below is tested by the
-      # job it is changing. Without this, those bumps merged unverified.
-      - ".github/workflows/mcpx.yml"
   push:
     branches: [main]
     paths:

.github/workflows/mod-tidy.yml

@@ -6,19 +6,6 @@ on:
     paths:
       - "pkgs/graph/**"
       - ".github/workflows/mod-tidy.yml"
-  pull_request:
-    paths:
-      - "pkgs/graph/**"
-      - ".github/workflows/mod-tidy.yml"
-
-# Push-to-main runs each get their own group (keyed by run_id), so a
-# later merge can never cancel — or displace a pending — verification
-# run for an earlier merge: every merged tree gets its own completed
-# run. Pull-request runs keep sharing a per-ref group, so a new push
-# to a PR still supersedes its stale run (#392). A conditional
-# cancel-in-progress (the mcpx-conformance pattern) would still let a
-# third rapid merge displace the second merge's pending run, so push
-# runs are keyed by run_id here, matching dezren39/nix PR #495.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.run_id || github.ref }}
   cancel-in-progress: true

.github/workflows/nix-ci.yml

@@ -4,7 +4,6 @@ name: nix ci
 on:
   push:
     branches: [main]
-  pull_request:
   # Merge queue pilot (see .github/ci-policy.md): the queue validates
   # the combined merge-group head, and this workflow's PR-tier job
   # (basic: proxy port fallbacks) is main's required status check —

.github/workflows/research-workflow.yml

@@ -1,23 +1,6 @@
 name: research-workflow
 
 on:
-  pull_request:
-    paths:
-      - "AGENTS.md"
-      - "CLAUDE.md"
-      - ".agents/**"
-      - "planning/**"
-      - "doc/README.md"
-      - "doc/DOCUMENTATION_PROTOCOL.md"
-      - "doc/**/main.md"
-      - "doc/**/transcript.txt"
-      - "doc/**/concepts/**"
-      - "doc/**/notes/**"
-      - "doc/**/receipts/**"
-      - "doc/**/decisions/**"
-      - "scripts/*research*workflow*.py"
-      - "scripts/tests/test_*workflow*.py"
-      - ".github/workflows/research-workflow.yml"
   push:
     branches: [main]
     paths: