From 2e92dc1200b073c6130e03111ae095cb20ef4f12 Mon Sep 17 00:00:00 2001
From: "posthog[bot]" <206114724+posthog[bot]@users.noreply.github.com>
Date: Sun, 30 Aug 2026 12:26:35 +0000
Subject: [PATCH] fix(desktop): stop cancelled desktop CI runs reporting as
 failures

The five desktop `*Pass` gates run with `if: always()`, so they run during a
cancel-in-progress cancellation and read their cancelled dependencies as
failures. A superseded run then posts a red required check with no test failure
behind it.

Add a `Note run cancellation` step guarded by `if: cancelled()` that writes a
flag to $GITHUB_ENV, then short-circuit the `Check results` step to exit 0 when
the flag is set. cancelled() is true only for a whole-run cancel, so a
job-level cancel or timeout leaves the run uncancelled and still reaches the
per-dependency guards. The gate keeps `if: always()` and every guard, so WF007
still passes.

Generated-By: PostHog Desktop
Task-Id: 2fd66c79-a5de-4c09-9913-72c7fa7e82ae
---
 .agents/skills/authoring-ci-workflows/SKILL.md |  6 ++++++
 .github/workflows/desktop-build.yml            | 11 +++++++++++
 .github/workflows/desktop-ci.yml               | 11 +++++++++++
 .github/workflows/desktop-quality.yml          | 11 +++++++++++
 .github/workflows/desktop-test.yml             | 11 +++++++++++
 .github/workflows/desktop-typecheck.yml        | 11 +++++++++++
 6 files changed, 61 insertions(+)

diff --git a/.agents/skills/authoring-ci-workflows/SKILL.md b/.agents/skills/authoring-ci-workflows/SKILL.md
index b5a6f01ec7c2..ce91694253ec 100644
--- a/.agents/skills/authoring-ci-workflows/SKILL.md
+++ b/.agents/skills/authoring-ci-workflows/SKILL.md
@@ -105,6 +105,12 @@ Adding another predicate can skip the required check, so `always() && <condition
 `!cancelled()` is identical to `always()` on any run that is not cancelled, so failure-path reporting still works; only cancelled runs skip.
 Measured on a live superseded run ([evidence](https://github.com/PostHog/posthog/actions/runs/29765284128)): an `always()` worker dispatched and ran to completion _after_ the cancel, while the `!cancelled()` worker never started and reported `cancelled` (not `skipped`), so the gate still fails closed.
 
+The cost of that `always()` gate is a red required check on every superseded run: the gate runs during the cancel, reads its cancelled dependencies, and fails.
+That red sits on a dead SHA — the newer commit that superseded it runs its own gate — but it still reads as a hard failure and trains people to reflex-rerun.
+To drop it without opening a false-green hole, add a `Note run cancellation` step guarded by `if: ${{ cancelled() }}` that writes `RUN_CANCELLED=true` to `$GITHUB_ENV`, then short-circuit the `Check results` step to `exit 0` when that flag is set (the desktop suite gates do this).
+`cancelled()` is true only for a whole-run cancel, so a job-level cancel or timeout leaves the run uncancelled and still reaches the per-dependency guards.
+The `Check results` step keeps no `if:` and keeps every guard, so `WF007` still sees each dependency reach a fail-closed guard.
+
 Four rules for the gate body:
 
 1. **Allowlist every dependency, never denylist.** Assert `success`/`skipped` and fail everything else.
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 717a3628cd0a..7cd51efc2ef9 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -127,8 +127,19 @@ jobs:
         timeout-minutes: 5
         if: always()
         steps:
+            # A superseded run (cancel-in-progress) cancels its jobs. That is not a
+            # test failure, so note it and let the check below pass instead of
+            # posting a red required check. cancelled() is true only for a whole-run
+            # cancel, so a job-level cancel or timeout still reaches the guards.
+            - name: Note run cancellation
+              if: ${{ cancelled() }}
+              run: echo "RUN_CANCELLED=true" >> "$GITHUB_ENV"
             - name: Check results
               run: |
+                  if [[ "${RUN_CANCELLED:-}" == "true" ]]; then
+                    echo "Run was cancelled (superseded); not treating it as a failure."
+                    exit 0
+                  fi
                   if [[ "${{ needs.changes.result }}" != "success" && "${{ needs.changes.result }}" != "skipped" ]]; then
                     echo "Change detection did not succeed (result: ${{ needs.changes.result }})."
                     exit 1
diff --git a/.github/workflows/desktop-ci.yml b/.github/workflows/desktop-ci.yml
index fe20eb20e8bd..00a05ba956b4 100644
--- a/.github/workflows/desktop-ci.yml
+++ b/.github/workflows/desktop-ci.yml
@@ -98,8 +98,19 @@ jobs:
         runs-on: depot-ubuntu-24.04
         timeout-minutes: 5
         steps:
+            # A superseded run (cancel-in-progress) cancels its jobs. That is not a
+            # test failure, so note it and let the check below pass instead of
+            # posting a red required check. cancelled() is true only for a whole-run
+            # cancel, so a job-level cancel or timeout still reaches the guards.
+            - name: Note run cancellation
+              if: ${{ cancelled() }}
+              run: echo "RUN_CANCELLED=true" >> "$GITHUB_ENV"
             - name: Check results
               run: |
+                  if [[ "${RUN_CANCELLED:-}" == "true" ]]; then
+                    echo "Run was cancelled (superseded); not treating it as a failure."
+                    exit 0
+                  fi
                   if [[ "${{ needs.build.result }}" != "success" && "${{ needs.build.result }}" != "skipped" ]]; then
                     echo "Desktop build did not succeed (result: ${{ needs.build.result }})."
                     exit 1
diff --git a/.github/workflows/desktop-quality.yml b/.github/workflows/desktop-quality.yml
index d50a318a8c91..5fd1b3a0037b 100644
--- a/.github/workflows/desktop-quality.yml
+++ b/.github/workflows/desktop-quality.yml
@@ -105,8 +105,19 @@ jobs:
         timeout-minutes: 5
         if: always()
         steps:
+            # A superseded run (cancel-in-progress) cancels its jobs. That is not a
+            # test failure, so note it and let the check below pass instead of
+            # posting a red required check. cancelled() is true only for a whole-run
+            # cancel, so a job-level cancel or timeout still reaches the guards.
+            - name: Note run cancellation
+              if: ${{ cancelled() }}
+              run: echo "RUN_CANCELLED=true" >> "$GITHUB_ENV"
             - name: Check results
               run: |
+                  if [[ "${RUN_CANCELLED:-}" == "true" ]]; then
+                    echo "Run was cancelled (superseded); not treating it as a failure."
+                    exit 0
+                  fi
                   if [[ "${{ needs.changes.result }}" != "success" && "${{ needs.changes.result }}" != "skipped" ]]; then
                     echo "Change detection did not succeed (result: ${{ needs.changes.result }})."
                     exit 1
diff --git a/.github/workflows/desktop-test.yml b/.github/workflows/desktop-test.yml
index c8e40f903503..07a04a41c7ca 100644
--- a/.github/workflows/desktop-test.yml
+++ b/.github/workflows/desktop-test.yml
@@ -351,8 +351,19 @@ jobs:
         timeout-minutes: 5
         if: always()
         steps:
+            # A superseded run (cancel-in-progress) cancels its jobs. That is not a
+            # test failure, so note it and let the check below pass instead of
+            # posting a red required check. cancelled() is true only for a whole-run
+            # cancel, so a job-level cancel or timeout still reaches the guards.
+            - name: Note run cancellation
+              if: ${{ cancelled() }}
+              run: echo "RUN_CANCELLED=true" >> "$GITHUB_ENV"
             - name: Check results
               run: |
+                  if [[ "${RUN_CANCELLED:-}" == "true" ]]; then
+                    echo "Run was cancelled (superseded); not treating it as a failure."
+                    exit 0
+                  fi
                   if [[ "${{ needs.changes.result }}" != "success" && "${{ needs.changes.result }}" != "skipped" ]]; then
                     echo "Change detection did not succeed (result: ${{ needs.changes.result }})."
                     exit 1
diff --git a/.github/workflows/desktop-typecheck.yml b/.github/workflows/desktop-typecheck.yml
index dac3195610d3..7466517cfe04 100644
--- a/.github/workflows/desktop-typecheck.yml
+++ b/.github/workflows/desktop-typecheck.yml
@@ -124,8 +124,19 @@ jobs:
         timeout-minutes: 5
         if: always()
         steps:
+            # A superseded run (cancel-in-progress) cancels its jobs. That is not a
+            # test failure, so note it and let the check below pass instead of
+            # posting a red required check. cancelled() is true only for a whole-run
+            # cancel, so a job-level cancel or timeout still reaches the guards.
+            - name: Note run cancellation
+              if: ${{ cancelled() }}
+              run: echo "RUN_CANCELLED=true" >> "$GITHUB_ENV"
             - name: Check results
               run: |
+                  if [[ "${RUN_CANCELLED:-}" == "true" ]]; then
+                    echo "Run was cancelled (superseded); not treating it as a failure."
+                    exit 0
+                  fi
                   if [[ "${{ needs.changes.result }}" != "success" && "${{ needs.changes.result }}" != "skipped" ]]; then
                     echo "Change detection did not succeed (result: ${{ needs.changes.result }})."
                     exit 1