From e56f171c24e7c308a9d96d470998c51f271bca83 Mon Sep 17 00:00:00 2001
From: Robert M1 <50460704+githubrobbi@users.noreply.github.com>
Date: Fri, 26 Jun 2026 09:16:02 -0700
Subject: [PATCH] ci(pr-fast): run heavy jobs only in the merge queue, not on
 every PR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The heavy jobs (sanity / clippy{,-no-default} / rustdoc / test-build /
tests / security / windows-lint) ran on BOTH `pull_request` and
`merge_group` — i.e. the full Rust suite executed twice per PR: once on
the branch in isolation, then again in the queue against current main.

Gate them with `&& github.event_name != 'pull_request'` so they run only
on `merge_group` (the queue) and `push` (main). The queue already
revalidates every PR against current main before merging, and the
contributor's local `lint-pre-push` gate runs the same suite before the
push — so the `pull_request` pass is a redundant third run. This halves
Rust-PR CI without losing safety.

The `required` aggregator already treats `skipped` as a pass, so a PR
goes green (heavy jobs skipped) and can enter the queue; on `merge_group`
the jobs run for real and gate the merge. Cheap checks (fmt / file-size /
drift / classify) stay on `pull_request` for fast author feedback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/pr-fast.yml | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/pr-fast.yml b/.github/workflows/pr-fast.yml
index e522dc89f..d27934740 100644
--- a/.github/workflows/pr-fast.yml
+++ b/.github/workflows/pr-fast.yml
@@ -336,12 +336,25 @@ jobs:
   # sanity — `cargo check` + `cargo-vet`.  The fastest compile gate;
   # downstream heavy jobs `needs: sanity` so a type error aborts before
   # paying for clippy / tests / Windows.
+  #
+  # Heavy jobs (sanity / clippy{,-no-default} / docs / test-build / tests /
+  # security / windows-lint) carry `&& github.event_name != 'pull_request'`
+  # so they run ONLY on `merge_group` (the merge queue) and `push` (main),
+  # not on the PR itself.  Rationale: the merge queue revalidates every PR
+  # against current `main` before merging, so a `pull_request` run is a
+  # redundant second pass — the contributor's local `lint-pre-push` gate
+  # already ran the same full suite before the push.  Running heavy CI once,
+  # in the queue, halves Rust-PR CI without losing safety.  The `required`
+  # aggregator below treats these jobs' `skipped` (on PRs) as a pass, so a
+  # PR still goes green and can enter the queue; on `merge_group` they run
+  # for real and gate the merge.  Cheap checks (fmt / file-size / drift /
+  # classify) stay on `pull_request` for fast author feedback.
   # ─────────────────────────────────────────────────────────────────────
   sanity:
     name: Sanity (cargo check + vet)
     runs-on: ubuntu-22.04
     needs: classify
-    if: needs.classify.outputs.code == 'true'
+    if: needs.classify.outputs.code == 'true' && github.event_name != 'pull_request'
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -383,7 +396,7 @@ jobs:
     name: Clippy
     runs-on: ubuntu-22.04
     needs: [classify, sanity]
-    if: needs.classify.outputs.code == 'true'
+    if: needs.classify.outputs.code == 'true' && github.event_name != 'pull_request'
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -415,7 +428,7 @@ jobs:
     name: Clippy (--no-default-features)
     runs-on: ubuntu-22.04
     needs: [classify, sanity]
-    if: needs.classify.outputs.code == 'true'
+    if: needs.classify.outputs.code == 'true' && github.event_name != 'pull_request'
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -445,7 +458,7 @@ jobs:
     name: Rustdoc + doctests
     runs-on: ubuntu-22.04
     needs: [classify, sanity]
-    if: needs.classify.outputs.code == 'true'
+    if: needs.classify.outputs.code == 'true' && github.event_name != 'pull_request'
     timeout-minutes: 30
     env:
       RUSTDOCFLAGS: "-Dwarnings"
@@ -478,7 +491,7 @@ jobs:
     name: Test build
     runs-on: ubuntu-22.04
     needs: [classify, sanity]
-    if: needs.classify.outputs.code == 'true'
+    if: needs.classify.outputs.code == 'true' && github.event_name != 'pull_request'
     timeout-minutes: 30
     env:
       # `debuginfo=1` for useful backtraces without paying the full
@@ -517,7 +530,7 @@ jobs:
     name: Tests
     runs-on: ubuntu-22.04
     needs: [classify, test-build]
-    if: needs.classify.outputs.code == 'true'
+    if: needs.classify.outputs.code == 'true' && github.event_name != 'pull_request'
     timeout-minutes: 30
     env:
       # Must match test-build exactly so the cargo fingerprint lines up
@@ -561,7 +574,7 @@ jobs:
     name: Security (deny + vet)
     runs-on: ubuntu-22.04
     needs: classify
-    if: needs.classify.outputs.code == 'true'
+    if: needs.classify.outputs.code == 'true' && github.event_name != 'pull_request'
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -643,7 +656,7 @@ jobs:
     name: Windows clippy
     runs-on: windows-latest
     needs: [classify, sanity]
-    if: needs.classify.outputs.code == 'true'
+    if: needs.classify.outputs.code == 'true' && github.event_name != 'pull_request'
     timeout-minutes: 25
     env:
       # Windows-appropriate target-cpu baseline (same as release.yml's