[d-morrison]

Ezra's standing rule (2026-11-02): "always cancel stale runs". On Ezra's decision (2026-11-03) to roll this out to every Morrison-Lab repo with PR CI, this adds a 17-line caller for Morrison-Lab/gha's cancel-superseded.yml (gha#1400, gha#1401, on v3). On every synchronize and closed of a pull request it cancels that PR's queued and running runs for any head other than the current one, and every earlier run of a closed PR. Runs not tied to a PR (push to main) are not covered. Not exercised before merge: the first live run is this PR's own next push or close.

---

Generated by Claude Code

[github-actions]

Claude finished review — View run

---

Confirmed: this PR touches exactly one file, a new 13-line .github/workflows/cancel-superseded.yml caller for Morrison-Lab/gha's reusable cancel-superseded.yml@v3 workflow.

Review

Scope & intent. Matches the stated rollout: a thin caller that triggers on pull_request: [synchronize, closed] and delegates to Morrison-Lab/gha/.github/workflows/cancel-superseded.yml@v3. I fetched that reusable workflow at the v3 tag and confirmed it exists, matches the described behavior (cancels queued/running runs for stale PR heads, and pre-close runs for closed PRs; explicitly skips fork and Dependabot PRs since GitHub won't surface a PR link or grant write tokens for those), and requests exactly actions: write + pull-requests: read — the same permissions this caller grants at the workflow level. I also confirmed gha#1400/gha#1401 are real issues/PRs describing this exact rollout (614 queued runs, 68 stale, overwhelming self-hosted runners), so the citations aren't fabricated.

Caller-permissions contract. .github/workflows/check-caller-permissions.yml (unchanged, already in this repo) runs on any PR touching .github/workflows/** and fails if a caller under-grants permissions relative to what the callee's job requests. This caller's top-level permissions: block (actions: write, pull-requests: read) matches the callee job's requested permissions exactly, so that check should pass.

Overlap with existing concurrency setups. lint-changed-files.yaml already has its own concurrency: group: lint-changed-${{ pr }}, cancel-in-progress: true, and claude-code-review.yml/preview.yml/preview-deploy.yml rely on cancellation built into their respective reusable workflows. This new workflow is complementary, not redundant — it's the umbrella mechanism for the other workflows (check-links, check-spelling, publish, etc.) that have no per-PR dedup of their own. No conflict; not a finding.

YAML validity. Parsed cleanly; on/permissions/jobs structure is syntactically correct for GitHub Actions.

Runner selection. psc is a public repo, so the callee's runs-on default (inputs.runs-on || (repo.private && vars.CI_RUNNER) || 'ubuntu-latest') resolves to ubuntu-latest — no accidental use of a self-hosted runner on a public repo, which the callee's own doc comment specifically warns against.

Minor: PR description line-count is off. The PR body says "this adds a 17-line caller," but the actual file (and the diff hunk, @@ -0,0 +1,13 @@) is 13 lines. Not a code defect — doesn't affect behavior or CI — but worth a quick correction in the description since this run explicitly asked to watch for confident-but-inaccurate claims. Likely just carried over from the gha repo's examples/cancel-superseded.yml stub (which may include header comments pushing it to 17 lines) without re-counting for the trimmed version actually committed here.

No bugs, no CLAUDE.md violations (this is pure CI infrastructure, not .qmd/R content), no build-hygiene or dependency concerns, and no second-guessing needed on the gha reference — it checks out.

Verdict

Ready for merge — one cosmetic nit in the PR description (line-count claim), no blocking findings.

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "fdd230215196dde97d04ddde51d03b33afac6df2",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "The sole changed path, .github/workflows/cancel-superseded.yml, is a 13-line reusable-workflow caller whose permissions and trigger types match the Morrison-Lab/gha@v3 callee's requirements, so no failure mode or defect was found in the workflow file itself.",
  "holistic_assessment": "Requirement traceability to gha#1400/#1401 checks out, the existing check-caller-permissions.yml contract is satisfied, no regression or duplication with lint-changed-files.yaml's own concurrency group, and scope stays limited to the single infra file with no validation gaps."
}

Reviewed commit: fdd2302

[github-actions]

💰 Cost: $0.4039 (review) — run

[github-actions]

PR Preview Action v1.8.1
🚀 Preview available at: https://Morrison-Lab.github.io/psc/pr-preview/pr-88/

_{Built to branch gh-pages at 2026-11-03 16:43 UTC.}