NO-ISSUE: Cancel in-flight e2e work and dismiss orphan gates on PR close

.github/scripts/cancel-stale-e2e-runs.sh

@@ -5,20 +5,38 @@
 # Cancels all three suite workflows (VMaaS/BMaaS/CaaS) regardless of which
 # caller invokes this script.
 #
-# Env: REPO, HEAD_SHA, HEAD_BRANCH, HEAD_REPO, PR_NUMBER
+# CANCEL_ALL=true (PR closed/merged): cancel every in-flight run for this PR
+# branch, including ones matching HEAD_SHA, and skip the "did the PR head
+# move on" guard -- there's no newer push to defer to once the PR is closed,
+# and nothing further needs this SHA's e2e result.
+#
+# Env: REPO, HEAD_SHA, HEAD_BRANCH, HEAD_REPO, PR_NUMBER, CANCEL_ALL
 
 set -euo pipefail
 
+readonly CANCEL_ALL="${CANCEL_ALL:-false}"
+
 if [[ -z "${REPO:-}" || -z "${HEAD_SHA:-}" || -z "${HEAD_BRANCH:-}" || -z "${HEAD_REPO:-}" ]]; then
   echo "REPO, HEAD_SHA, HEAD_BRANCH, and HEAD_REPO are required" >&2
   exit 1
 fi
 
+# CANCEL_ALL drops the "differs from HEAD_SHA" scoping below, so it leans on
+# repo+branch alone to identify "this PR's runs" -- not enough on its own if a
+# branch name is ever reused across PRs (delete-and-recreate, or a stale run
+# from a previous close/reopen cycle). Require an exact PR_NUMBER match too.
+if [[ "${CANCEL_ALL}" == "true" && -z "${PR_NUMBER:-}" ]]; then
+  echo "PR_NUMBER is required when CANCEL_ALL=true" >&2
+  exit 1
+fi
+
 # Return 0 when PR head still matches HEAD_SHA; 1 when moved or lookup failed.
+# Always 0 in CANCEL_ALL mode: a closed PR's head won't move, and there's no
+# newer push for this cleanup to defer to.
 pr_head_still_current() {
   local current_head
 
-  if [[ -z "${PR_NUMBER:-}" ]]; then
+  if [[ "${CANCEL_ALL}" == "true" || -z "${PR_NUMBER:-}" ]]; then
     return 0
   fi
   current_head=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}" --jq '.head.sha // empty')
@@ -55,25 +73,28 @@ for status in in_progress queued waiting pending requested; do
     if ! pr_head_still_current; then
       break 2
     fi
-    if [[ "${sha}" == "${HEAD_SHA}" ]]; then
+    if [[ "${CANCEL_ALL}" != "true" && "${sha}" == "${HEAD_SHA}" ]]; then
       echo "Skipping ${name} #${id}: matches current PR head"
       continue
     fi
-    echo "Cancelling stale ${name} #${id} (${sha:0:7} != ${HEAD_SHA:0:7})"
+    echo "Cancelling ${name} #${id} (${sha:0:7})"
     if gh api -X POST "repos/${REPO}/actions/runs/${id}/force-cancel" 2>/dev/null \
       || gh run cancel "${id}" -R "${REPO}"; then
       cancelled=$((cancelled + 1))
     else
       echo "Could not cancel run #${id}" >&2
       failed=1
     fi
-  done < <(jq -r --arg head "${HEAD_SHA}" --arg repo "${HEAD_REPO}" --argjson names "${E2E_NAMES}" '
+  done < <(jq -r --arg head "${HEAD_SHA}" --arg repo "${HEAD_REPO}" --argjson names "${E2E_NAMES}" \
+    --argjson all "$([[ "${CANCEL_ALL}" == "true" ]] && echo true || echo false)" \
+    --argjson pr "${PR_NUMBER:-0}" '
     .[] | select(
       .head_repository.full_name == $repo
-      and .head_sha != $head
+      and ($all or .head_sha != $head)
+      and (if $all then ((.pull_requests // []) | any(.number == $pr)) else true end)
       and (.name as $n | $names | index($n))
     ) | "\(.id)\t\(.name)\t\(.head_sha)"
   ' <<<"${runs}")
 done
-echo "Cancelled ${cancelled} stale full-install run(s)."
+echo "Cancelled ${cancelled} run(s)."
 exit "${failed}"

.github/workflows/e2e-cancel-on-pr-close.yml

@@ -0,0 +1,76 @@
+---
+# Stop e2e work the moment a PR closes -- merged or not -- instead of letting
+# in-flight full-install runs finish for no reason, or leaving invalidate-time
+# in_progress gate checks (see e2e-on-label's invalidate-e2e-gates) sitting
+# unresolved forever once nothing will ever complete them. pull_request_target
+# uses the base-branch workflow YAML and base-repo GITHUB_TOKEN (required to
+# cancel runs and patch checks on fork PRs).
+name: Cancel e2e on PR close
+on:
+  pull_request_target:
+    types: [closed]
+    branches: [main]
+
+jobs:
+  # Re-check live PR state before cleanup runs: pull_request_target's event
+  # payload reflects state at trigger time, and a queued/delayed run could
+  # fire after the PR was reopened -- cancelling e2e work or dismissing gate
+  # checks a reopened PR still needs. Cheap guard, no side effects of its own.
+  guard:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      still-closed: ${{ steps.check.outputs.still-closed }}
+    steps:
+      - id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          state=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}" --jq '.state')
+          if [[ "${state}" == "closed" ]]; then
+            echo "still-closed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "PR #${PR_NUMBER} is ${state}, not closed anymore; skipping cleanup."
+            echo "still-closed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  cancel-in-flight-runs:
+    needs: guard
+    if: needs.guard.outputs.still-closed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/scripts/cancel-stale-e2e-runs.sh
+      - name: Cancel all in-flight full-install runs for this PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          CANCEL_ALL: "true"
+        run: bash .github/scripts/cancel-stale-e2e-runs.sh
+
+  dismiss-orphan-gates:
+    needs: guard
+    if: needs.guard.outputs.still-closed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+    steps:
+      - name: Dismiss any remaining in_progress gate checks
+        uses: osac-project/osac-test-infra/.github/actions/complete-stale-e2e-gates@main
+        with:
+          head-sha: ${{ github.event.pull_request.head.sha }}
+          after-native-success: false
+          github-token: ${{ secrets.MERGE_QUEUE_TOKEN }}