[quality] test.yml runs build-test twice per commit on every PR branch — narrow push to main and add a concurrency group #213

Finding

.github/workflows/test.yml:2 is on: [push, pull_request] and the workflow has no concurrency block. Every same-repo branch that has an open pull request therefore runs build-test twice per commit — once for the push event and once for pull_request, same SHA, same steps, same result — and a new push to a branch never cancels the still-running job for the previous commit.

Evidence, main @ 187c5e3:

• chore(deps-dev): bump the dev-dependencies group across 1 directory with 5 updates #188 head 8656298: run 36255852284 (push, started 16:33:01) and run 36255855092 (pull_request, started 16:33:04) — identical SHA, both fail on the same step.
• Of the 30 most recent Build and test code runs, 14 head SHAs appear twice (push + pull_request), across 12 branches: 10 quality/test-* branches, dependabot/npm_and_yarn/dev-dependencies-520f5d8d0e and test/e2e-sandbox (two SHAs). Reproduce: gh run list --workflow test.yml --limit 30 --json headSha,event | jq 'group_by(.headSha)|map(select(length>1))|length'.
• prow-bot.yml:34-36 already declares a concurrency group for the bot; test.yml is the only pull_request workflow in the repository without one.

Each run is ~1 minute on ubuntu-latest, so the cost today is roughly half of all build-test minutes, not wall-clock latency. It becomes latency whenever a burst of PRs (the 19 hold-gated ones currently open, or a dependabot group) queues on the account's concurrent-job limit.

Recommendation

Fire once per commit and let a newer push to a pull request supersede the pending run. Exact replacement — replace lines 1-5 of .github/workflows/test.yml (name: through contents: read) with:

name: Build and test code
on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

# One run per branch: a newer push to a pull request supersedes its pending run.
# Runs on main are never cancelled, so every merge keeps its own result.
concurrency:
  group: test-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

The jobs: map is unchanged.

Notes for the maintainer applying this:

• push: branches: [main] removes the duplicate outright: a same-repo PR branch runs only through pull_request; main still runs on every merge. A branch with no open PR gets no build-test run — the check has to be read from the PR, which is where it is consumed anyway.
• github.head_ref || github.ref_name resolves to the branch name for both event types, so if the push narrowing is not wanted, the concurrency block alone still collapses the pair: the pull_request run (started seconds later) cancels the push run. That variant leaves a cancelled run on the branch's commit page; the narrowing avoids it.
• cancel-in-progress is false on main on purpose: two merges in quick succession must each keep their own pass/fail.
• Tag pushes currently also run test.yml; release.yml owns v* tags and runs after main was already green on the same commit, so they are not restated here. Add tags: ['v*'] under push: if that run is wanted back.
• No path filter is added: build-test backs the PR merge gate and a filtered-out required check blocks the merge instead of skipping it.

Why no PR: the whole change is inside .github/workflows/. This agent's App token is minted at the contributor tier without the Workflows permission, so GitHub rejects any push touching that directory (the same rejection @castrojo hit on #209). It needs a human or an ISSUES_PRS_MERGE-tier agent to land. No part of the fix lies outside .github/workflows/.

Completion criteria

• test.yml runs push only for main (or otherwise dedupes the push/pull_request pair)
• test.yml has a concurrency group that cancels superseded pull_request runs and never cancels main
• The next same-repo PR commit produces exactly one build-test run

Priority

• Impact: low — ~2× build-test minutes and slower burst throughput; no correctness effect
• Effort: low

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 187c5e3

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88