chore(ci): per-PR runner reductions — merge test+checks, job-level gating, draft skips, one-runner previews

[JSONbored]

Summary

This repo's Validate fan-out (5 jobs per PR, two of them 30-minute-class each running their own npm ci + full build) plus ~100 preview builds/week made it the largest consumer of the account's shared 20-concurrent-job pool (observed today: a 40+-deep starved queue that froze the sibling repo's release automation for hours). Same-day mirror of JSONbored/loopover#8523.

1. test + checks merge into one job. One npm ci + one build serves the suite and the ~20 validators. The old split bought wall-clock (max instead of sum) at the cost of a second heavy runner on every PR — at current volume the pool, not wall-clock, is the binding constraint. Step order is load-bearing and documented in place: contract-drift validators before the build (they compare committed files the build overwrites), derived-artifact freshness after the build and before the suite (whose artifact writers mutate staging trees), suite + Codecov last. The docs fast lane and the narrow workflows/migrations skips survive unchanged as per-step guards (the suite half must run even on docs-only diffs — coverage is repo-wide).

2. python is path-gated at the job level on a new changes.run_python_validation flag (^python/ — its hermetic suite reads nothing else). Job-level skips are safe here and this is now documented where the old hedge was: main has zero required status contexts (verified via branches/main/protection) and fetchLiveCiAggregate buckets skipped identically to success.

3. ui's per-step guard pattern becomes a job-level if for the same reason — a backend PR no longer boots a full runner just to check out and evaluate ~18 false guards.

4. Draft PRs skip every heavy job (and the types list gains ready_for_review, so marking ready triggers a real run — mirrors ui-preview.yml's existing list).

5. Same-repo UI PRs deploy their preview in ONE runner via the new shared .github/actions/deploy-ui-preview composite; ui-preview-deploy.yml becomes fork-only, skipping runner-free for same-repo builds via the head_repository comparison. The fork trust boundary (secretless build → trusted workflow_run deploy, artifact validation, trusted-config-only wrangler) is preserved byte-for-byte inside the composite.

Net: a typical backend PR drops 5 → 2 jobs (changes + merged test), UI PRs 7 → 4, python-only PRs keep a fast lane.

Validation

npm run validate:workflows (22 files) green; tests/pipeline-validator-parity.test.ts green (the merged job invokes the identical npm run validate:* set); actionlint clean on all touched files; Prettier clean. The merged job's first live run on this PR is the end-to-end proof of the step ordering.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.61%. Comparing base (d6cada6) to head (43b0fcc).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8017   +/-   ##
=======================================
  Coverage   97.61%   97.61%           
=======================================
  Files         215      215           
  Lines       26898    26898           
  Branches    10649    10649           
=======================================
  Hits        26257    26257           
  Misses        150      150           
  Partials      491      491           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.