From 1b7bb8151ab80d6a0aea150378bcdd7c8eef4b8a Mon Sep 17 00:00:00 2001
From: zipg <geeky@foxmail.com>
Date: Tue, 29 Sep 2026 02:57:04 +0800
Subject: [PATCH] ci: skip aggregate gates when run is cancelled

---
 .github/scripts/ci-guide.md          | 5 ++++-
 .github/scripts/ci-workflow.test.mjs | 5 ++++-
 .github/workflows/ci.yml             | 8 ++++----
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/scripts/ci-guide.md b/.github/scripts/ci-guide.md
index d39375747..0ed06a557 100644
--- a/.github/scripts/ci-guide.md
+++ b/.github/scripts/ci-guide.md
@@ -6,7 +6,10 @@ Paths in this guide are relative to `.github/`.
 does not change release workflows or branch-protection settings. The existing
 `rust` and `agents` aggregate check names remain; `ci` additionally summarizes all
 selected jobs. None of these gates accepts a failed, cancelled, missing, or
-unexpectedly skipped prerequisite.
+unexpectedly skipped prerequisite. The gates are guarded by
+`if: always() && !cancelled()`: on a superseded commit a newer push cancels the
+run, and `always()` alone would still execute the gate and report those
+cancellations as a failure of the commit that no longer matters.
 
 ## Selection
 
diff --git a/.github/scripts/ci-workflow.test.mjs b/.github/scripts/ci-workflow.test.mjs
index 81acf84e3..522a986d0 100644
--- a/.github/scripts/ci-workflow.test.mjs
+++ b/.github/scripts/ci-workflow.test.mjs
@@ -44,7 +44,10 @@ test("stable Rust, Agent and overall gates always inspect selected upstream resu
     ["ci", "all", ["rust", "agents", "frontend", "packages", "windows-standard-check", "windows-win7-bundle", "duckdb-windows-driver", "nix-packaging"]],
   ]) {
     const content = job(name);
-    assert.match(content, /if: always\(\)/);
+    // A superseded run must not leave a failing gate behind: when the workflow is
+    // cancelled the selected upstream jobs are cancelled too, and `always()` alone
+    // would still run the gate and report those cancellations as failures.
+    assert.match(content, /if: always\(\) && !cancelled\(\)/);
     assert.ok(content.includes(`node .github/scripts/ci-gate.mjs ${mode}`));
     assert.ok(content.includes("${{ toJSON(needs) }}"));
     assert.ok(content.includes("uses: actions/checkout@v7"));
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c8aab6c7d..e826be2a8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -132,7 +132,7 @@ jobs:
       - frontend-checks
       - frontend-typecheck
       - frontend-test
-    if: always()
+    if: always() && !cancelled()
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
@@ -932,7 +932,7 @@ jobs:
       - fast-checks
       - rust-fmt-clippy
       - rust-test
-    if: always()
+    if: always() && !cancelled()
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
@@ -1193,7 +1193,7 @@ jobs:
       - agent-rust
       - agent-go
       - agent-integration
-    if: always()
+    if: always() && !cancelled()
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
@@ -1472,7 +1472,7 @@ jobs:
       - jdbc
       - offline-jdbc-release
       - nix-packaging
-    if: always()
+    if: always() && !cancelled()
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7