ci: Skip GitHub Actions runs PRs don't need; never cancel master runs

.cursor/rules/ci-config.mdc

@@ -29,9 +29,16 @@ alwaysApply: false
 - `skills.yml` `paths` must cover every input of `website/framework-docs/skillReferences.mjs` (docs, skill manifests, the generator and its deps).
 - `editor-types.yml` reruns `yarn copy:websitetypes` and fails if `website/src/components/Playground/editor-types` changes. It needs the `website` workspace (for deps like `bignumber.js`), which CircleCI's `setup` drops. Its `paths` must cover every input of `scripts/copywebsitetypes.sh`.
 - `site-preview.yml` runs one `build` job (one install for the typecheck and the build). It builds the site directly (no Vercel CLI, only the packages it imports via `ci:build:website`, `VERCEL_ENV=preview` to include drafts), restores Docusaurus' webpack cache (only master pushes save it, so PRs share one entry), and fails on any `[WARNING]`/`[ERROR]` line. Broken links are `warn` in `docusaurus.config.ts` so this check catches them without failing Vercel deploys.
-- `site-preview.yml`/`site-release.yml` `paths` (`website/**`, `docs/{core,rest,graphql}/**`) must match `SITE_PATHS` in `website/scripts/vercel-ignore.sh`.
+- Production docs deploys come from Vercel's Git integration only (gated by `vercel-ignore.sh`); there is no Actions deploy workflow. Vercel clones ~10 commits deep, so `website/scripts/deepenGitHistory.cjs` (called from `docusaurus.config.ts`) fetches 800 more for the "Last updated" dates.
+- `site-preview.yml` `paths` (`website/**`, `docs/{core,rest,graphql}/**`) must match `SITE_PATHS` in `website/scripts/vercel-ignore.sh`.
 - `benchmark-react.yml` caches Playwright browsers keyed on the resolved `playwright` version from `examples/benchmark-react`; bumping playwright invalidates the cache automatically.
 - Benchmark workflows (`benchmark.yml`, `benchmark-react.yml`) tune the host (CPU governor, swapoff) and pin CPUs with `taskset` — they must run directly on the runner, not in a `container:`.
+- Never cancel a run on master: a cancelled check marks the commit red, which hurts npm search scoring. PR runs cancel superseded ones (`group: <name>-${{ github.head_ref || github.run_id }}`, `cancel-in-progress: true`); push runs get a unique group. Runs that must not overlap (`release.yml`, `beta-release.yml`) use a shared group with `queue: max`, which keeps up to 100 pending runs in order instead of cancelling all but one (GitHub rejects it alongside `cancel-in-progress: true`; actionlint 1.7.12 doesn't know the key yet). The benchmark push groups still use the default single pending slot.
+- Report-style workflows (`benchmark*.yml`, `bundle_size.yml`, `codeql-analysis.yml`) skip draft PRs with a job-level `if: ${{ !github.event.pull_request.draft }}` and list `ready_for_review` in `pull_request.types`, so they run once a PR is marked ready. Correctness checks (`editor-types`, `skills`, `website`) still run on drafts.
+- `paths` leave out what a workflow never reads, so test- or docs-only edits under `packages/` don't fan out: `__tests__/`, `typescript-tests/`, `src-*-types/` (legacy types) and `*.md`. `bundle_size.yml` also skips packages `examples/test-bundlesize` doesn't bundle (graphql, test, vue).
+- CodeQL triggers only on shipped source (`packages/*/src/**`, `packages/*/node.mjs`). `bundle_size.yml` is PR-only: on push the action measures but has nowhere to report.
+- Bundle Size and the benchmarks list `yarn.lock` in `paths` but gate their main job on the reusable `dependency-gate.yml` (`scripts/ci-deps-relevant.mjs`). It runs the job when a non-manifest file in the workflow's paths changed, a manifest of the measured workspaces (or a workspace package they ship with) changed, or the yarn.lock resolutions reachable from their dependencies or the babel/browserslist/core-js build tooling changed. Bumps of test, lint, React Native or website tooling skip it; anything it can't classify runs. The gate reads the caller's `on.<event>.paths` itself (via `github.workflow_ref` and `yq`), so there's one list. Root `devDependencies` aren't walked: add a new root build dependency to `BUILD_TOOLS`.
+- Renovate (`.github/renovate.json`) uses `rebaseWhen: conflicted`: master's branch protection requires up-to-date branches, which makes the default rebase every Renovate PR (and rerun all of its CI) on each master push. Update the branch before merging a Renovate PR; if that update isn't merged, Renovate treats the branch as edited and stops rebasing it until its PR's rebase checkbox is ticked.
 
 ## Vercel docs site (`website/scripts/vercel-ignore.sh`)
 

.github/renovate.json

@@ -4,6 +4,7 @@
   "commitMessagePrefix": "pkg: ",
   "commitMessageTopic": "`{{depName}}`",
   "dependencyDashboardApproval": true,
+  "rebaseWhen": "conflicted",
   "rangeStrategy": "auto",
   "ignoreDeps": [
     "whatwg-fetch",

.github/workflows/benchmark-react.yml

@@ -2,6 +2,7 @@ name: Benchmark React
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches:
       - master
     paths:
@@ -10,6 +11,11 @@ on:
       - 'packages/endpoint/src/schemas/**'
       - 'packages/normalizr/src/**'
       - 'examples/benchmark-react/**'
+      - '!packages/**/__tests__/**'
+      - '!examples/benchmark-react/**/*.md'
+      - 'yarn.lock'
+      - 'scripts/ci-deps-relevant.mjs'
+      - '.github/workflows/dependency-gate.yml'
       - '.github/workflows/benchmark-react.yml'
   push:
     branches:
@@ -20,6 +26,11 @@ on:
       - 'packages/endpoint/src/schemas/**'
       - 'packages/normalizr/src/**'
       - 'examples/benchmark-react/**'
+      - '!packages/**/__tests__/**'
+      - '!examples/benchmark-react/**/*.md'
+      - 'yarn.lock'
+      - 'scripts/ci-deps-relevant.mjs'
+      - '.github/workflows/dependency-gate.yml'
       - '.github/workflows/benchmark-react.yml'
 
 concurrency:
@@ -31,7 +42,16 @@ permissions:
   pull-requests: write
 
 jobs:
+  # Skips dependency bumps that can't change what this measures
+  changes:
+    if: ${{ !github.event.pull_request.draft }}
+    uses: ./.github/workflows/dependency-gate.yml
+    with:
+      workspaces: examples/benchmark-react
+
   benchmark-react:
+    needs: changes
+    if: ${{ needs.changes.outputs.relevant == 'true' }}
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/benchmark-spread.yml

@@ -7,15 +7,20 @@ name: Benchmark Spread
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches:
       - master
     paths:
       - 'packages/core/src/state/**'
       - 'packages/normalizr/src/normalize/**'
       - 'packages/endpoint/src/schemas/EntityMixin.ts'
+      - '!packages/**/__tests__/**'
       - 'examples/benchmark/spread.js'
       - 'examples/benchmark/spread-scenarios.js'
       - 'examples/benchmark/schemas.js'
+      - 'yarn.lock'
+      - 'scripts/ci-deps-relevant.mjs'
+      - '.github/workflows/dependency-gate.yml'
       - '.github/workflows/benchmark-spread.yml'
   push:
     branches:
@@ -24,9 +29,13 @@ on:
       - 'packages/core/src/state/**'
       - 'packages/normalizr/src/normalize/**'
       - 'packages/endpoint/src/schemas/EntityMixin.ts'
+      - '!packages/**/__tests__/**'
       - 'examples/benchmark/spread.js'
       - 'examples/benchmark/spread-scenarios.js'
       - 'examples/benchmark/schemas.js'
+      - 'yarn.lock'
+      - 'scripts/ci-deps-relevant.mjs'
+      - '.github/workflows/dependency-gate.yml'
       - '.github/workflows/benchmark-spread.yml'
 permissions:
   contents: write
@@ -37,8 +46,16 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  benchmark-spread:
+  # Skips dependency bumps that can't change what this measures
+  changes:
+    if: ${{ !github.event.pull_request.draft }}
+    uses: ./.github/workflows/dependency-gate.yml
+    with:
+      workspaces: examples/benchmark
 
+  benchmark-spread:
+    needs: changes
+    if: ${{ needs.changes.outputs.relevant == 'true' }}
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/benchmark.yml

@@ -2,13 +2,19 @@ name: Benchmark
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     branches:
       - master
     paths:
       - 'packages/normalizr/src/**'
       - 'packages/endpoint/src/schemas/**'
       - 'packages/core/src/**'
       - 'examples/benchmark/**'
+      - '!packages/**/__tests__/**'
+      - '!examples/benchmark/**/*.md'
+      - 'yarn.lock'
+      - 'scripts/ci-deps-relevant.mjs'
+      - '.github/workflows/dependency-gate.yml'
       - '.github/workflows/benchmark.yml'
   push:
     branches:
@@ -18,6 +24,11 @@ on:
       - 'packages/endpoint/src/schemas/**'
       - 'packages/core/src/**'
       - 'examples/benchmark/**'
+      - '!packages/**/__tests__/**'
+      - '!examples/benchmark/**/*.md'
+      - 'yarn.lock'
+      - 'scripts/ci-deps-relevant.mjs'
+      - '.github/workflows/dependency-gate.yml'
       - '.github/workflows/benchmark.yml'
 permissions:
   contents: write
@@ -28,8 +39,16 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  benchmark:
+  # Skips dependency bumps that can't change what this measures
+  changes:
+    if: ${{ !github.event.pull_request.draft }}
+    uses: ./.github/workflows/dependency-gate.yml
+    with:
+      workspaces: examples/benchmark
 
+  benchmark:
+    needs: changes
+    if: ${{ needs.changes.outputs.relevant == 'true' }}
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/beta-release.yml

@@ -12,7 +12,10 @@ on:
         default: 'beta'
         type: string
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+# Queue every run instead of cancelling pending ones (red on the branch)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  queue: max
 
 jobs:
   beta-release:

.github/workflows/bundle_size.yml

@@ -1,30 +1,41 @@
 name: Bundle Size
 
 on:
+  # PR-only: on push the action measures but has nowhere to report
   pull_request:
-    # The branches below must be a subset of the branches above
+    types: [opened, synchronize, reopened, ready_for_review]
     branches: [ master ]
     paths:
       - 'packages/**'
+      - '!packages/**/__tests__/**'
+      - '!packages/*/typescript-tests/**'
+      - '!packages/*/src-*-types/**'
+      - '!packages/**/*.md'
+      # not bundled by examples/test-bundlesize
+      - '!packages/graphql/**'
+      - '!packages/test/**'
+      - '!packages/vue/**'
       - 'yarn.lock'
       - 'examples/test-bundlesize/**'
-      - '.github/workflows/bundle_size.yml'
-  push:
-    branches:
-      - master
-    paths:
-      - 'packages/**'
-      - 'yarn.lock'
-      - 'examples/test-bundlesize/**'
+      - 'scripts/ci-deps-relevant.mjs'
+      - '.github/workflows/dependency-gate.yml'
       - '.github/workflows/bundle_size.yml'
 
 concurrency:
-  group: bundle-size-${{ github.head_ref || github.ref }}
+  group: bundle-size-${{ github.head_ref }}
   cancel-in-progress: true
 
 jobs:
-  build:
+  # Skips dependency bumps that can't change what this measures
+  changes:
+    if: ${{ !github.event.pull_request.draft }}
+    uses: ./.github/workflows/dependency-gate.yml
+    with:
+      workspaces: examples/test-bundlesize
 
+  build:
+    needs: changes
+    if: ${{ needs.changes.outputs.relevant == 'true' }}
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/codeql-analysis.yml

@@ -11,24 +11,34 @@
 #
 name: "CodeQL"
 
+# Shipped source only: manifests, docs and tests can't add alerts that matter
 on:
   push:
     branches: [ master ]
     paths:
-      - 'packages/**'
+      - 'packages/*/src/**'
+      - 'packages/*/node.mjs'
+      - '!packages/**/__tests__/**'
+      - '.github/workflows/codeql-analysis.yml'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     # The branches below must be a subset of the branches above
     branches: [ master ]
     paths:
-      - 'packages/**'
+      - 'packages/*/src/**'
+      - 'packages/*/node.mjs'
+      - '!packages/**/__tests__/**'
+      - '.github/workflows/codeql-analysis.yml'
   schedule:
     - cron: '25 22 * * 5'
 
 permissions:
   contents: read
 
+# PRs cancel superseded runs. Push runs get their own group, so master never
+# shows a cancelled (red) run.
 concurrency:
-  group: codeql-${{ github.head_ref || github.ref }}
+  group: codeql-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
@@ -38,6 +48,7 @@ jobs:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/autobuild to send a status report
     name: Analyze
+    if: ${{ !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
 
     strategy:

.github/workflows/dependency-gate.yml

@@ -0,0 +1,38 @@
+name: dependency gate
+# Reusable: tells a workflow whether its change can affect what it measures,
+# so dependency bumps of unrelated tooling skip it. See scripts/ci-deps-relevant.mjs.
+on:
+  workflow_call:
+    inputs:
+      workspaces:
+        description: Comma-separated workspaces the job builds and runs
+        required: true
+        type: string
+    outputs:
+      relevant:
+        value: ${{ jobs.check.outputs.relevant }}
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    outputs:
+      relevant: ${{ steps.deps.outputs.relevant }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+      - id: deps
+        env:
+          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+          WORKSPACES: ${{ inputs.workspaces }}
+        run: |
+          # A missing base makes the script fail open
+          git fetch -q --depth=1 origin "$BASE" || true
+          # The caller's own `paths` filter (github.workflow_ref names the
+          # caller). Unreadable means none: any changed file counts.
+          workflow="${GITHUB_WORKFLOW_REF#*/*/}"
+          mapfile -t paths < <(yq -r ".on.${GITHUB_EVENT_NAME}.paths[]" "${workflow%@*}" || true)
+          node scripts/ci-deps-relevant.mjs "$BASE" "$WORKSPACES" "${paths[@]}"

.github/workflows/editor-types.yml

@@ -7,6 +7,10 @@ on:
     # Inputs of scripts/copywebsitetypes.sh
     paths:
       - 'packages/**'
+      - '!packages/**/__tests__/**'
+      - '!packages/*/typescript-tests/**'
+      - '!packages/*/src-*-types/**'
+      - '!packages/**/*.md'
       - 'scripts/copywebsitetypes.sh'
       - 'scripts/strip-dts-comments.mjs'
       - 'scripts/globals.ts'
@@ -22,6 +26,10 @@ on:
       - master
     paths:
       - 'packages/**'
+      - '!packages/**/__tests__/**'
+      - '!packages/*/typescript-tests/**'
+      - '!packages/*/src-*-types/**'
+      - '!packages/**/*.md'
       - 'scripts/copywebsitetypes.sh'
       - 'scripts/strip-dts-comments.mjs'
       - 'scripts/globals.ts'
@@ -33,8 +41,10 @@ on:
       - 'tsconfig*.json'
       - '.github/workflows/editor-types.yml'
 
+# PRs cancel superseded runs. Push runs get their own group, so master never
+# shows a cancelled (red) run.
 concurrency:
-  group: editor-types-${{ github.head_ref || github.ref }}
+  group: editor-types-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:

.github/workflows/release.yml

@@ -5,7 +5,10 @@ on:
     branches:
       - master
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+# Queue every run instead of cancelling pending ones (red on the branch)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  queue: max
 
 jobs:
   release:

.github/workflows/site-preview.yml

@@ -21,8 +21,10 @@ on:
       - 'docs/graphql/**'
       - '.github/workflows/site-preview.yml'
 
+# PRs cancel superseded runs. Push runs get their own group, so master never
+# shows a cancelled (red) run.
 concurrency:
-  group: site-preview-${{ github.head_ref || github.ref }}
+  group: site-preview-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs: