fix(actions): isolate MV3 PR runs

[seonghobae]

Workflow-owner candidate — keep Draft

This PR carries a useful MV3 control-plane delta, but its current exact head ebeefcd534db4324498fdb18046ebc6255ddcdf2 is based on #245 a769f484e2c110e0523b3b28cd21573f43867562, not protected main@87c4daa1830bac5a5228b6036752ad5633232085. It is intentionally Draft until the authorized #212 workflow-owner path reconstructs the valid intent on the protected workflow generation.

Valid intent to preserve

• isolate pull-request concurrency by workflow + repository + PR number;
• keep manual dispatch runs independent instead of cancelling them with PR runs;
• admit opened, synchronize, reopened, and ready_for_review pull-request events;
• avoid spending the hosted runner on Draft PR jobs.

Current protected-generation conflict

Protected #286 already has MV3 lifecycle types [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed] and a job guard requiring github.event.action != 'closed' && github.event.pull_request.draft == false for PR runs. This predecessor-relative patch would remove converted_to_draft and closed from the trigger list and simplify the guard to draft == false. Promoted verbatim, it would therefore regress the protected Draft/closed lifecycle and capacity contract.

The local tests.test_mv3_compatibility_contract/actionlint result proves only this branch's predecessor-relative workflow shape; it does not prove compatibility with the current protected workflow.

Repair path

Issue #212 is the canonical workflow owner. Reconstruct/adopt the concurrency/manual-dispatch delta there on the current protected MV3 workflow, preserving #286's converted_to_draft/closed triggers, closed-event fail-closed guard, permissions, harden-runner egress restrictions, immutable action pins, and browser/sandbox evidence. Then run fresh exact-head workflow contracts and pinned-Chromium evidence.

Exact-head review 5120039692 and #212 comment 5549868655 record the conflict. Do not Close this PR merely to reduce queue count; its valid workflow intent must first be adopted by the canonical owner. No force-push, destructive rebase, self-approval, bypass, workflow weakening, tag, release, or publication is authorized.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: b3f13576-c0f3-477f-bcab-3fb5e7cfad91

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Repair finding on exact ebeefcd...: this workflow-only PR is based on #245 a769f484..., not current protected main@87c4daa.... Current main already carries #286 lifecycle semantics: MV3 listens to opened, synchronize, reopened, ready_for_review, converted_to_draft, closed, isolates PR/manual concurrency, and rejects closed plus Draft PRs in the job guard. This patch's four-event trigger and simpler Draft-only guard therefore represent a predecessor workflow generation, not a safe current-main successor. Do not promote it by overwriting #286 or interpreting its #245-relative clean diff as current-main compatibility. Preserve the valid PR-number/manual-dispatch concurrency intent, but reconstruct/adopt it only in the authorized workflow-owner path on the live protected generation, with the Ready-transition defect and Draft/closed capacity guards exercised together. No workflow mutation is performed by this scheduled product writer.

[seonghobae]

Exact-head workflow review on ebeefcd534db4324498fdb18046ebc6255ddcdf2: this one-commit child is based on #245 (a769f484...), not current protected main@87c4daa.... Its MV3 workflow delta would narrow the protected PR event list from [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed] to [opened, synchronize, reopened, ready_for_review] and would replace the current job guard (action != 'closed' && draft == false) with draft == false only. That would drop the #286 closed/converted-to-draft lifecycle contract if promoted verbatim.

The PR-number/manual-dispatch concurrency intent is still useful. Preserve that semantic delta, but reconstruct it in the authorized #212 workflow-owner lane on the current protected workflow generation so #286 lifecycle/capacity behavior is retained. Do not merge this predecessor-relative workflow blob or weaken lifecycle coverage merely because its local contract tests pass.