Cancel a PR's orphaned workflow runs when the PR is closed

[hmgaudecker]

Closes the gap that blocked the GPU queue for 84 minutes today.

The problem

GitHub does not cancel a PR's queued or in-progress runs when the PR is closed.
main.yml's concurrency guard cannot cover this:

concurrency:
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

That only supersedes a run when a newer run appears on the same head ref. Closing a PR
is not a new run, so it never fires.

With a single self-hosted GPU runner, the orphans become head-of-line blockers.

Observed 2026-08-03. PR #413 (grid-search-ez → reachability) was open from 11:21:03
to 11:23:48 — 2m45s. Its run 30809182760 outlived it by ~84 minutes, sitting in the GPU
queue in front of #414 until the runs were cancelled by hand at 12:45. #390's run also had
to be force-cancelled: its 32-bit GPU job ignored the ordinary cancel endpoint entirely.

The fix

A reaper on pull_request_target: [closed] that cancels runs for that head ref.

Five things worth reviewing:

• Scope: PRs closed without merging. closed also fires on merge, so the job is
  guarded by if: github.event.pull_request.merged == false. Merged PRs' runs are
  deliberately left to finish.
• pull_request_target, not pull_request — the token is read-only for fork PRs on
  pull_request, so the reaper would silently no-op on exactly the PRs least likely to be
  cleaned up by hand. This is only safe because the job never checks out or executes PR
  code; it reads the head ref and calls the REST API. Do not add a checkout step.
• No injection surface. On a fork PR the head ref is attacker-controlled, so it reaches
  jq via $ENV and gh via -f (which also URL-encodes it) — never a shell word or a raw
  query string. Branch names may legally contain & and #.
• Live-PR guard. A head ref can back more than one PR — retargeting a stack branch is
  the obvious case here. The job bails if any other open PR still points at the same head
  repo + ref, so closing one cannot cancel a live one's runs.
• Bounded escalation to force-cancel. 120s grace, then force. Without this the
  workflow would not have fixed today's incident: the graceful cancel was ignored.

Known cost of exempting merged PRs

This is documented at the guard so it isn't rediscovered the hard way. benchmark-pr runs
in concurrency group gpu-benchmarks-<head_ref>, while the post-merge benchmark-main run
uses gpu-benchmarks-main — different groups, so merging does not supersede the PR's
benchmark run. With timeout-minutes: 14400 (10 days) and a while nvidia-smi … sleep 60
wait-for-GPU loop, a benchmark run started on a PR can hold the benchmark runner well past
the merge. Cancel it by hand if that happens.

Verification

Ran against live API state before committing:

check	result
-f branch="feat/dcegm" filters correctly (slash in ref)	matches, 3 runs
$ENV works in gh's jq (gojq)	yes
live-PR guard on reachability (#414 open)	still_open=1 → skips
run query for grid-search-ez	finds 30809182760
that run's status when #413 closed	queued → inside the filter, would have been reaped
set -e survives [ … ] && continue	survives
bash -n on the extracted run: block	OK
yamllint, check-github-workflows, full prek	pass

Not exercised end-to-end on GitHub — pull_request_target runs the version of the workflow
on the base branch, so it does nothing until this lands on main. The first real test
is the next PR closed without merging.

[read-the-docs-community]

Documentation build overview

📚 pylcm | 🛠️ Build #33891987 | 📁 Comparing d7048d4 against latest (7325297)

  🔍 Preview build  

39 files changed · ± 39 modified

± Modified

• index.html
• age-specialized/index.html
• approximating-continuous-shocks/index.html
• architecture/index.html
• benchmarking/index.html
• benchmarking-1/index.html
• beta-delta/index.html
• continuous-stochastic-processes/index.html
• conventions/index.html
• debugging/index.html
• and 29 more...

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.39%. Comparing base (56f244d) to head (dcd135e).
⚠️ Report is 190 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #415      +/-   ##
==========================================
- Coverage   98.30%   90.39%   -7.92%     
==========================================
  Files          42      170     +128     
  Lines        2415    15153   +12738     
==========================================
+ Hits         2374    13697   +11323     
- Misses         41     1456    +1415     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.