From 01a7a7b939af3eba31e776dc07e0e7bee3c47874 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sun, 12 Jul 2026 16:42:21 +0300
Subject: docs-infra: run workers tests on PRs (gap let broken deps land)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

apex-deploy.yml's test job only triggered on push to rolling, so no
PR-level check ran the workers/ vitest suite — that's how the vitest
3.2/pool-workers 0.18.4 peer conflict landed on rolling undetected
(two dependabot PRs merged clean since nothing exercised `npm ci` in
workers/ pre-merge).

Add a `pull_request` trigger scoped to `workers/**` so the test job
runs pre-merge. Gate deploy-canary and deploy-production with
`if: github.event_name != 'pull_request'` so PR runs test only —
no canary/production deploys fire on a PR (deploy-production would
also auto-skip via `needs: deploy-canary` once canary skips, but the
explicit `if:` keeps intent visible). Concurrency group now branches
per-event so PR runs queue/cancel independently of the rolling deploy
group instead of colliding with it.

Validated with actionlint + a YAML parse check.

🤖 Generated by [robots](https://vyos.io)
---
 .github/workflows/apex-deploy.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/apex-deploy.yml b/.github/workflows/apex-deploy.yml
index 1528221b..efa42fd7 100644
--- a/.github/workflows/apex-deploy.yml
+++ b/.github/workflows/apex-deploy.yml
@@ -4,10 +4,14 @@ on:
   push:
     branches: [rolling]
     paths: ["workers/**"]
+  pull_request:
+    paths: ["workers/**"]
   workflow_dispatch: {}
 
 concurrency:
-  group: apex-deploy-${{ github.ref_name }}
+  # PR runs group per head ref so pushes to the same PR queue/cancel independently
+  # of the rolling deploy group.
+  group: apex-deploy-${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
   # false (not true): a mid-job cancel can leave the apex/preview worker pair
   # half-updated; queuing subsequent runs is safe.
   cancel-in-progress: false
@@ -26,6 +30,7 @@ jobs:
 
   deploy-canary:
     needs: test
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -58,6 +63,7 @@ jobs:
 
   deploy-production:
     needs: deploy-canary
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     environment: docs-production   # requires reviewer approval (§7.2)
     steps:
-- 
cgit v1.2.3