ci: skip aggregate gates when run is cancelled

.github/scripts/ci-guide.md

@@ -6,7 +6,10 @@ Paths in this guide are relative to `.github/`.
 does not change release workflows or branch-protection settings. The existing
 `rust` and `agents` aggregate check names remain; `ci` additionally summarizes all
 selected jobs. None of these gates accepts a failed, cancelled, missing, or
-unexpectedly skipped prerequisite.
+unexpectedly skipped prerequisite. The gates are guarded by
+`if: always() && !cancelled()`: on a superseded commit a newer push cancels the
+run, and `always()` alone would still execute the gate and report those
+cancellations as a failure of the commit that no longer matters.
 
 ## Selection
 

.github/scripts/ci-workflow.test.mjs

@@ -44,7 +44,10 @@ test("stable Rust, Agent and overall gates always inspect selected upstream resu
     ["ci", "all", ["rust", "agents", "frontend", "packages", "windows-standard-check", "windows-win7-bundle", "duckdb-windows-driver", "nix-packaging"]],
   ]) {
     const content = job(name);
-    assert.match(content, /if: always\(\)/);
+    // A superseded run must not leave a failing gate behind: when the workflow is
+    // cancelled the selected upstream jobs are cancelled too, and `always()` alone
+    // would still run the gate and report those cancellations as failures.
+    assert.match(content, /if: always\(\) && !cancelled\(\)/);
     assert.ok(content.includes(`node .github/scripts/ci-gate.mjs ${mode}`));
     assert.ok(content.includes("${{ toJSON(needs) }}"));
     assert.ok(content.includes("uses: actions/checkout@v7"));

.github/workflows/ci.yml

@@ -132,7 +132,7 @@ jobs:
       - frontend-checks
       - frontend-typecheck
       - frontend-test
-    if: always()
+    if: always() && !cancelled()
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
@@ -932,7 +932,7 @@ jobs:
       - fast-checks
       - rust-fmt-clippy
       - rust-test
-    if: always()
+    if: always() && !cancelled()
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
@@ -1193,7 +1193,7 @@ jobs:
       - agent-rust
       - agent-go
       - agent-integration
-    if: always()
+    if: always() && !cancelled()
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
@@ -1472,7 +1472,7 @@ jobs:
       - jdbc
       - offline-jdbc-release
       - nix-packaging
-    if: always()
+    if: always() && !cancelled()
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7