fix(ci): defer repository-local jobs while PRs are Draft

[seonghobae]

Finding

Fresh Actions state showed 106 queued workflow runs and 0 in-progress runs in LineageWeave while the active implementation PRs remained Draft. The protected-main repository-local workflows still admitted expensive Full suite, Frontend, PROV-O and ontology-validation jobs on Draft opened/synchronize events. That spends scarce runner admission on work that cannot be merged yet and compounds the documented organization-level concurrent-job ceiling.

This PR does not claim to raise the organization plan limit or change central required-workflow policy. ContextualWisdomLab/.github remains the canonical owner of organization-required workflows and queue coalescing. This repair only stops LineageWeave-owned repository-local jobs from consuming runners while a PR is Draft.

RED → causal repair

• RED 470dca8db680ec56a740f4eee5a618eb1517d6ea pins the repository contract: Tests, PROV-O, and Ontology Pages must listen for ready_for_review / converted_to_draft, and their expensive PR jobs must require github.event.pull_request.draft == false.
• 2552d92ba5478f4e2a093e2811f7fc1c5c7af5e8 applies the admission boundary to Full suite and Frontend.
• cd23edfee3517829e11f301a581352f2a864d778 applies it to the PROV-O contract job.
• 81df80ca040df57a8964056c3bda07cdab90f1b8 applies it to ontology validation while leaving protected-main publication behavior unchanged.

The event design is deliberate. converted_to_draft remains in the same PR concurrency group so it can cancel an older queued synchronize run; its expensive jobs then skip. ready_for_review reruns the exact head when review readiness returns. The guard is job-level rather than a workflow-level omission, preserving a terminal skipped/success check shape instead of creating a required-check path that may never report.

Boundary and safety

• protected base: main@03dddb69ef7c2910798801803bb222dffcaac5e3
• exact head: 81df80ca040df57a8964056c3bda07cdab90f1b8
• compare: behind_by=0, four workflow/contract files only
• no product/domain code, provider configuration, secrets, branch-protection policy, or central .github source is copied or weakened
• non-PR Ontology Pages publication remains isolated and non-cancelling
• no force push, rebase, self-approval, or predecessor evidence transfer

The repository-wide queue is currently capacity-starved, so hosted exact-head execution may itself be unable to acquire a runner. The CWL execution contract explicitly permits ordinary bypass merge for a chicken-and-egg workflow-ceiling repair when the repair cannot obtain the capacity it is intended to conserve. If the exact head cannot acquire a runner, merge eligibility must still be limited to this narrowly reviewed workflow repair; this exception must not be generalized to product changes.

[coderabbitai]

Warning

Review limit reached

Next included review available in 2 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 519e9c41-0e12-4837-b293-ea09e26373f1

📥 Commits

Reviewing files that changed from the base of the PR and between 03dddb6 and 81df80c.

📒 Files selected for processing (4)

• .github/workflows/ontology-pages.yml
• .github/workflows/prov-o-contract.yml
• .github/workflows/tests.yml
• tests/test_tests_workflow_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Validated finding against protected main: repository-local Tests, PROV-O and Ontology Pages admitted expensive jobs for Draft pull-request events even though the repository currently had a 106-run queued backlog and no in-progress run. The RED contract precedes the workflow repairs. Scope remains CI admission only: central required workflows and the organization plan ceiling are not reimplemented or weakened here. Before any merge, retain exact-head identity and ordinary merge semantics; no self-approval or predecessor GREEN transfer.