ci: batch trunk-PR CI on the merge train's ci:run label

[kjgbot]

Prepares relay for the merge-train sweeper (AgentWorkforce/cloud packages/web/lib/merge-train), porting cloud #4350/#4351. Same shape as the merged relaycast#497, relayauth#101, relayfile#546 and relayhistory#399. relay stays in dry-run.

main here requires an approving review. Until Khaliq decides otherwise, promotion stays human-approved: the sweeper can open and maintain the trunk -> main PR, but GitHub will refuse its merge without a human approval.

Changes

• All 18 promotion workflows now run the trunk -> main PR only when ci:run is added (labeled trigger; every job requires the ci:run label event). Opened, reopened and synchronize run nothing. targeted-feature-verification also drops ready_for_review, and relayflow-pr-proof-broker's pull_request_target drops synchronize, edited and ready_for_review. large-files.yml moves from on: [pull_request] to the mapping form.
  • Every gated job skips label events other than ci:run. Jobs that already had extra conditions keep them as (gate) && (...).
• Concurrency:
  • Unrelated label events get a throwaway ignored-<run_id> group, so they can't cancel a real promotion run (#4351).
  • Push runs on main key off the sha instead of github.ref, so merges no longer cancel each other.
  • relayflow-pr-proof-broker keeps its per-head group, plus the ignored-label throwaway.
• New merge-train-ready.yml (Merge-train ready check): runs on feature PRs into trunk while mergeable is on, including fork PRs. Under pull_request a fork gets no secrets and a read-only token; trust is the sweeper's gate. Events the job will skip get a throwaway group. Steps: npm ci, the contract test, npm run lint, format:check and typecheck.
• scripts/merge-train-ci-workflows.test.mjs:
  • discovers every pull-request workflow except trunk-guard and the closed-only cancel-on-merge;
  • pins its trigger types and the exact job gate (an extra && condition is allowed, a top-level || bypass isn't);
  • pins the throwaway groups, the sweeper marker changes / Detect change scope (test.yml's changes job) and the ready check.

Effect on manual promotion

A human trunk -> main PR (e.g. #1939) gets CI only when ci:run is added, by the sweeper or by hand. Pushes to trunk no longer re-run it automatically.

Verification

• node --test scripts/merge-train-ci-workflows.test.mjs: 4/4 pass. Red-first: 3 of 4 fail against the old workflows.
• actionlint shows no new findings (one pre-existing ubuntu-20.04 label warning in test-install.yml).
• prettier --check passes on every changed file.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes when and how CI runs for all promotion PRs and merge-train gates; misconfiguration could block merges or skip required checks, but behavior is contract-tested and limited to workflow YAML.

Overview
Aligns relay with the merge-train sweeper by batching full promotion CI on the trunk → main PR until the ci:run label is applied, instead of running on every PR open/sync.

Promotion workflows (~18): pull_request triggers switch to types: [labeled] only; job if conditions additionally require action == labeled and label.name == ci:run for same-repo trunk → main PRs. Pushes to main and manual dispatch behavior are unchanged. Concurrency is reworked so PR runs group per PR (cancel in progress), push runs key off commit SHA (parallel merges don’t cancel each other), and non-ci:run label events use throwaway ignored-* groups so they can’t cancel a real run.

New merge-train-ready.yml: Lightweight gate for PRs targeting trunk while the mergeable label is present (labeled / synchronize / reopened), running lint, format, typecheck, and the workflow contract test—intended for feature PRs before merge-train promotion.

scripts/merge-train-ci-workflows.test.mjs pins the shared contract (gate expression, labeled-only triggers, ignored concurrency groups, sweeper CI marker job, ready check shape). pr-proof-contract.test.ts expectations for relayflow-pr-proof-broker.yml are updated for the same label-gated promotion model.

^{Reviewed by Cursor Bugbot for commit 08978dd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: cf7d78e7-7f03-4223-995b-a7c51eaf45b7

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[cubic-dev-ai]

All reported issues were addressed across 19 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit de4ca5d. Configure here.}

[cubic-dev-ai]

All reported issues were addressed across 19 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[kjgbot]

Closing: the merge train is cloud-only now (Khaliq's decision). This repo goes back to normal per-PR CI on main, and a separate revert PR removes the trunk gating and the merge-train snippet.