test(actions): isolate GitHub-hosted runner admission

[seonghobae]

Incident boundary

Issue #712 still has independent exact-current-head jobs queued before any step or checkout:

• ContextualWisdomLab/ConceptWeave#5@ed22957471f7c62b644f68e4f37bdb86327d8668, Product run 33562998629, job 100039652518: requested label ubuntu-24.04, runner_id=0, empty runner identity and zero steps;
• ContextualWisdomLab/ConceptWeave#6@7657222d8004191f4a5dffd23cfa6f51d5d6adb5, Product run 33563608323, job 100041625887: requested label ubuntu-24.04, runner_id=0, empty runner identity and zero steps; and
• central Dependency Review A/B diagnostic ContextualWisdomLab/.github#1643@a1f0e77143e1121414b2fbf6080fdd209137020f, run 33566686450, job 100051373011: requested label ubuntu-24.04, runner_id=0, empty runner identity and zero steps.

Those jobs have no matrix, environment approval or executed dependency. The dependency-review HTTP A/B hypothesis cannot be evaluated until its job first acquires a runner.

Test-first diagnostic

Base is protected main@cfcde258dc2836838d00982ed812dd3b9d6072ca; exact head at PR creation is dd2c20bccefa604f972caf61900a26f942cc80a0.

RED was observed locally with the permanent contract present and the workflow absent: all three tests failed at the missing canary boundary. GREEN then passed after adding the bounded workflow.

The canary deliberately has only:

• pull_request events bounded to its own workflow and contract paths;
• one job on exactly ubuntu-latest;
• no checkout, action, matrix, needs, environment, credential or job environment;
• permissions: {};
• one run: "true" step;
• a unique per-run concurrency identity with no cancellation; and
• a two-minute job ceiling.

This isolates hosted-runner admission from source checkout, reusable workflows, dependency APIs, credentials, environments and repository code. It does not mutate any leaf source head and does not weaken a required gate.

Interpretation and lifecycle

• If this exact canary remains runner_id=0 with zero steps while the three cited jobs remain queued, treat organization/hosted-runner capacity, scheduler, quota or billing/control-plane availability as the leading boundary and inspect the authorized settings plane.
• If this canary acquires a runner while the unchanged leaf jobs do not, compare label/image availability and the leaf workflow's concurrency/event conditions before changing source.
• Do not rerun repeatedly without a causal condition change.
• This is diagnostic-only. After decisive evidence is recorded on ops: diagnose and bound organization GitHub Actions queue starvation #712, remove the canary workflow and contract rather than merging permanent no-op load.

No self-approval, bypass, synthetic status or predecessor evidence is requested.

Refs #712, #810, #1643.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}