[dhruv8sh]

Summary

• One author opening or pushing to many pull requests could fill the shared runner pool and make everyone else's CI wait. Each PR-triggered workflow now gets a concurrency group keyed on the workflow and the PR author (github.event.pull_request.user.login), so an author has at most one run in progress per workflow and their extra runs wait as pending without holding a runner. Keying on the author rather than github.actor means a maintainer pushing to or clicking "Update branch" on contributors' PRs does not pile those runs into the maintainer's queue.
• queue: max keeps every waiting run and starts them in order. The default single-pending queue would silently cancel an author's older waiting run whenever they open another PR. Every job now sets timeout-minutes, so a hung job cannot hold an author's queue for GitHub's 6-hour default.
• Pushes to main, scheduled runs, manual dispatches and bot-authored PRs (for example Dependabot) fall back to github.run_id, so they get their own group and are never held behind anyone's queue.

Changes

File	Change
.github/workflows/test.yml	Add per-PR-author concurrency group with queue: max; add timeout-minutes to the six jobs that lacked one
.github/workflows/format.yml	Same concurrency group; add timeout-minutes to all five jobs
.github/workflows/codeql.yml	Same concurrency group; add timeout-minutes to analyze
.github/workflows/integration-tests.yml	Same concurrency group (jobs already had timeouts)
.github/workflows/pbs-example.yml	Same concurrency group (job already had a timeout)

deploy-docs.yml and docs-proposal.yml are untouched: they only run on main and already define their own concurrency.

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
  cancel-in-progress: false
  queue: max

New timeouts are about 3x the longest of each job's last five main runs, with a 10-minute floor (5 for the symlink guard):

Job	Longest recent run	Timeout
test-axum	10.8 min	30
test-cloudflare	2.9 min	15
test-spin	5.2 min	20
test-parity	3.1 min	15
test-cli (macOS leg)	14.9 min	45
test-typescript	1.1 min	10
check-claude-md-symlink	0.1 min	5
format-rust	7.2 min	25
format-typescript	0.6 min	10
format-docs	0.8 min	10
docs-proposal-scripts	0.3 min	10
CodeQL analyze (rust leg)	11.7 min	45

Known trade-offs: several pushes to the same PR now run one after another rather than in parallel, and a re-run joins the back of the author's queue. Cancelling a PR's superseded runs needs a separate privileged workflow, since a workflow can only have one concurrency group; that is left for a follow-up.

Closes

Closes #1425

Spec

Spec: Not a feature (CI change)

Test plan

• cargo test-fastly && cargo test-axum (and cargo test-cloudflare)
• cargo clippy-fastly && cargo clippy-axum (and cargo clippy-cloudflare)
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other:
  • Live GitHub run: ran the concurrency block with queue: max in a throwaway private repo. One author opened three PRs back to back, then pushed to main while they were queued. The PR runs ran one at a time, in creation order, none cancelled (pr-2 started 4s after pr-1 finished, pr-3 4s after pr-2). The main push started 4s after it was created while two PR runs were still pending.
  • Group evaluation with act: evaluated each workflow's actual group: expression. Two PRs by one author map to one group, different authors to separate groups, a maintainer pushing to another author's PR to that author's group, and Dependabot PRs, push, schedule and workflow_dispatch to run-ID groups. The same script asserts every job sets timeout-minutes. Against the previous revision it fails on the maintainer, Dependabot and timeout checks, as expected.
  • actionlint 1.7.12 and act 0.2.89 both flag queue as an unknown key; their schemas predate it. GitHub accepts it, and docs-proposal.yml already uses queue: max on main.

Checklist

• Feature PRs: spec linked above, ending in a review log of two or more agent review rounds (n/a, not a feature)
• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...") (no Rust changes)
• Uses tracing macros (not println!) (no Rust changes)
• New code has tests (workflow config only; verified by the live run and act checks above)
• No secrets or credentials committed

[prk-Jr]

Summary

Reviewed all five changed workflows at 3d448f910c2c0445b979441452b29d401074d42d, including job dependencies, matrices, shared setup, triggers, permissions and concurrency policies. No blocking defects found; the implementation matches issue #1425. Author rather than actor grouping correctly handles maintainer updates, and all 18 job definitions have explicit timeouts.

Non-blocking observations

• 🤔 Workflow limits do not guarantee runner fairness — The concurrency block in .github/workflows/test.yml:16–19 admits one workflow run per author, but that run can launch eight jobs. Format and CodeQL can launch another eight simultaneously, alongside integration jobs. This substantially reduces burst multiplication, but still permits significant runner occupancy by one author. Measure contention after rollout before adding further serialization.

• 📝 Clarify queue capacity and ordering — The repeated comments in the five workflows say queued runs are preserved and run in order. GitHub permits 100 pending runs per group, then cancels additional arrivals. FIFO follows when runs begin waiting on the concurrency group, rather than workflow dispatch order. Consider documenting those qualifications in the shared wording and PR description. See GitHub concurrency documentation. Apply manually: this clarification spans five workflow files.

• 🏕 Retain the policy verification script — The PR describes useful expression checks with act, but the verification script is not included in the change. Keeping it in the repository would help catch drift across the five duplicated policies. Cover author versus actor, bots, non-PR events, group separation and timeout presence. Apply manually: retaining the script introduces a new file.

Suggested follow-up

Retain this author-level cap, then separately consider cancelling superseded runs within the same PR. That would reduce obsolete work while preserving the cap across different PRs. Any privileged cancellation workflow should manipulate Actions metadata without checking out or executing contributor code. Stale-run queueing is explicitly acknowledged in this PR and is not a blocker.

Validation

Local YAML/policy assertions passed for all five identical concurrency policies and all 18 job definitions; git diff --check passed. Local actionlint reported its outdated schema for queue and shell warnings on unchanged lines. Current GitHub documentation confirms queue: max is supported. Rust/JS suites were not rerun locally for this workflow-only change, and the reported live multi-PR experiment was not independently reproduced.

CI Status

• browser integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• integration tests: PASS
• CodeQL: PASS
• cargo test (ts CLI, native) (macos-latest): PASS
• Analyze (actions): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• Analyze (javascript-typescript): PASS
• cargo test (axum native): PASS
• docs-proposal scripts: PASS
• format-docs: PASS (required)
• Analyze (rust): PASS
• prepare integration artifacts: PASS
• format-typescript: PASS (required)
• cargo test: PASS (required)
• CLAUDE.md symlink guard: PASS
• cargo fmt: PASS (required)
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• vitest: PASS
• cargo test (cross-adapter parity): PASS
• cargo test (ts CLI, native) (ubuntu-latest): PASS
• PBS Terraform and Compose checks: PASS
• Analyze (javascript-typescript): PASS
• Analyze (python): PASS

[ChristianPavilonis]

Approved. Queuing PR CI runs per author and workflow, with bounded job timeouts and independent groups for bots and non-PR runs, is a focused improvement to shared runner fairness.

[aram356]

Summary

This adds a per-PR-author concurrency group with queue: max to the five PR-triggered workflows, and a timeout-minutes on every job. The timeouts hold up against the last 400 runs of each workflow and against the cold runs after the Rust 1.98.1 upgrade. Two things block: without superseded-run cancellation, the per-author queue delays required checks by hours and can hit the 100-pending cap, and nothing keeps the new invariants in place as open PRs land.

1 of the inline comments below carries a one-click GitHub suggestion — use Commit suggestion to apply it as a commit on the PR branch. The remaining comments describe the fix in prose because the change touches multiple files or lines outside the diff and can't be auto-applied.

Blocking

🔧 wrench

• Per-author queue without superseded-run cancellation — see inline at .github/workflows/test.yml:17
• Enforce the shared block and job timeouts — see inline at .github/workflows/format.yml:58

Non-blocking

🤔 thinking

• Bot exemption covers the runs nobody waits on — see inline at .github/workflows/test.yml:14

📝 note

• Windows axum leg from the module stack — see inline at .github/workflows/test.yml:81

CI Status

• integration tests: PASS
• browser integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• CodeQL: PASS
• cargo test (ts CLI, native) (macos-latest): PASS
• Analyze (python): PASS
• docs-proposal scripts: PASS
• Analyze (javascript-typescript): PASS (both runs)
• Analyze (rust): PASS
• vitest: PASS
• cargo fmt: PASS (required)
• cargo test (axum native): PASS
• CLAUDE.md symlink guard: PASS
• format-typescript: PASS (required)
• prepare integration artifacts: PASS
• cargo test (ts CLI, native) (ubuntu-latest): PASS
• format-docs: PASS (required)
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• cargo test (cross-adapter parity): PASS
• PBS Terraform and Compose checks: PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo test: PASS (required)
• Analyze (actions): PASS

[aram356]

Summary

Round 2 at 5068110d2. Both round-1 blockers are fixed: each workflow now cancels a PR's superseded run, each job queues per author, and the guard enforces both. A job-level replay of the 372 Run Tests PR runs from Oct 21 to 30, using uncontended job durations, shows the effect. For the stacked-PR author, the latest push's cargo test wait drops from p50 547 / max 1199 min under the round-1 design to p50 170 / max 393 min. prk-Jr's max falls from 266 to 8 min, job-hours fall from 275 to 239, and nothing is cancelled at the 100-pending cap. What blocks now is mechanical: the required cargo fmt check fails, the description still describes round 1, and the live check is open.

2 of the inline comments below carry a one-click GitHub suggestion — use Commit suggestion (or Add suggestion to batch) to apply them as commits on the PR branch. The remaining findings describe the fix in prose because the change touches lines outside the diff or the PR description.

Blocking

🔧 wrench

• The required cargo fmt check fails — see Cross-cutting below
• The PR description still describes round 1 — see Cross-cutting below

❓ question

• Live check of cancelling a run whose jobs wait in a job-level queue — see inline at .github/workflows/test.yml:20

Non-blocking

♻️ refactor

• The guard accepts three copy-paste mistakes — see inline at .github/workflows/format.yml:124

🤔 thinking

• The bot exemption is now the largest load source — see inline at .github/workflows/test.yml:28

⛏ nitpick

• 104-column comment line in all five workflows — see inline at .github/workflows/test.yml:17

Cross-cutting / body-level findings

• 🔧 The required cargo fmt check fails. The guard works as designed: the latest main merge brought in check-ci-node-pin (from #1257, format.yml) and lint-domains (from #1254, test.yml) without the new blocks (job log). Those lines are outside the diff, so there's no suggestion. Add these after each job's runs-on:, then merge main again (2 behind, and main requires up-to-date branches):

    check-ci-node-pin:
      name: CI Node pin guard
      runs-on: ubuntu-latest
      timeout-minutes: 5
      concurrency:
        group: ${{ github.workflow }}-check-ci-node-pin-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
        queue: max

    lint-domains:
      ...
      name: ts dev lint domains (changed lines)
      if: github.event_name == 'pull_request'
      runs-on: ubuntu-latest
      timeout-minutes: 10
      concurrency:
        group: ${{ github.workflow }}-lint-domains-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
        queue: max

  The timeouts follow the description's rule: the slowest recent runs were 0.3 min (52 runs) and 2.4 min (54 runs). Verified on a local merge with current main plus these blocks and both suggestions: the guard passes locally and in Docker, the Node pin checker reports 26 jobs OK and its tests pass 30/30, and the setup-rust guard passes.

• 🔧 The PR description still describes round 1. The summary and YAML snippet show cancel-in-progress: false and a workflow-level per-author group. "Known trade-offs" says cancelling superseded runs is left for a follow-up. The Changes table has no row for the guard or the per-job blocks, and the test plan's live run and act checks cover the old design. Please rewrite it for the current design and add the live-check result.

• 📝 Merge order. After this lands, the guard fails cargo fmt on rebase for #1107 (trace-runtime-tests; approved and behind main), #1433 (worker-auction-deadlines.yml), #1435 (release.yml), #1345 (inspector.yml) and draft #1460 (publisher-registration). Ten more already conflict with this PR in .github: the #1347 to #1423 stack, #1424, #1449, #917, #1002 and #1053. That's the guard doing its job, but those authors will want a heads-up. For #1435, the guard forces test.yml's block onto a workflow that also runs on tag pushes and has its own binary-attestations-${{ github.ref }} group. Tag pushes key on the run ID, so releases won't queue, but it's worth confirming that's intended.

• 🏕 AGENTS.md. The CI Gates list names the standalone guards (10, 12 and 13). One line saying every PR-triggered workflow needs test.yml's workflow-level block and every job needs a timeout and a per-author queue would tell agents before the guard fails their run.

CI Status

• cargo fmt: FAIL (required)
• cargo test: PASS (required)
• format-typescript: PASS (required)
• format-docs: PASS (required)
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• browser integration tests: PASS
• prepare integration artifacts: PASS
• CodeQL: PASS
• Analyze (actions): PASS
• Analyze (javascript-typescript): PASS (both runs)
• Analyze (python): PASS
• Analyze (rust): PASS
• cargo test (ts CLI, native) (macos-latest): PASS
• cargo test (ts CLI, native) (ubuntu-latest): PASS
• cargo test (cross-adapter parity): PASS
• cargo test (axum native): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• HTML EOF runtime (Fastly): PASS
• ts dev lint domains (changed lines): PASS
• CI Node pin guard: PASS
• CLAUDE.md symlink guard: PASS
• docs-proposal scripts: PASS
• vitest: PASS
• PBS Terraform and Compose checks: PASS

[aram356]

❓ question — In the earlier thread you planned to confirm in your throwaway repo that cancelling a superseded run also drops its jobs still waiting in a job-level queue, and to report back before merge. This PR can't show it yet: the three rework commits went up in one push, so its own history has no cancelled run. Could you post the result here? A run link is enough.

[aram356]

@dhruv8sh please resolve comments after addressing feedback

[aram356]

Summary

Round 3 at 32523f184. The round-2 asks mostly landed: check-ci-node-pin and lint-domains have their blocks, the guard is now scripts/check-ci-concurrency.sh with tests and checks the exact group shape (all three round-2 gaps now fail), AGENTS.md has gate 14, and the comment is rewrapped. I re-probed the script with 23 fixtures, ran it under bash 3.2, bash 5.2 with yq 4.54.1, and mutated it against its tests. What blocks: the guard fails on the merge ref, it no longer sits on a required check, the yq download is unverified, and the description and the live-check question from round 2 are still open.

3 of the inline comments below carry a one-click GitHub suggestion — use Commit suggestion (or Add suggestion to batch for several at once) to apply them as commits on the PR branch. The remaining findings describe the fix in prose because the change touches lines outside the diff, repository settings, or the PR description.

Blocking

🔧 wrench

• The guard fails on the merge ref (trace-runtime-tests from #1107) — see Cross-cutting below
• The guard no longer runs on a required check — see inline at .github/workflows/format.yml:97
• The yq download is not verified — see inline at .github/workflows/format.yml:73
• The PR description is still the round-1 text — see Cross-cutting below

❓ question

• The live check from round 2 is still open — see Cross-cutting below

Non-blocking

♻️ refactor

• The timeout check rejects expression timeouts — see inline at scripts/check-ci-concurrency.sh:146
• Six of the script's checks have no test — see inline at scripts/check-ci-concurrency.test.mjs:233

🌱 seedling

• The matrix check accepts partial keying — see inline at scripts/check-ci-concurrency.sh:73

Cross-cutting / body-level findings

• 🔧 The guard fails on the merge ref. #1107 landed on main with a trace-runtime-tests job that has a timeout but no per-author block, so CI Node pin guard fails on this PR's merge ref (job log). The branch is also 5 behind main, and main requires up-to-date branches. Merge main (it merges cleanly) and add this after that job's timeout-minutes: 45 in integration-tests.yml:

      concurrency:
        group: ${{ github.workflow }}-trace-runtime-tests-${{ github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot' && github.event.pull_request.user.login || github.run_id }}
        queue: max

  Verified on a local merge with current main plus this block and all three suggestions: the guard exits 0 locally and in Docker (bash 5.2, yq 4.54.1), the concurrency tests pass 11/11, the Node pin tests pass 30/30 and it reports 27 jobs OK, the setup-rust guard passes, the YAML parses, and actionlint reports nothing new.

• 🔧 The PR description is still the round-1 text. It shows cancel-in-progress: false and a workflow-level per-author group, says cancelling superseded runs is left for a follow-up, and its Changes table, timeouts table and test plan predate both reworks. It now also leaves out scripts/check-ci-concurrency.sh and its tests, AGENTS.md gate 14 and the scripts/README.md row.

• ❓ The live check is still open. The round-2 question at .github/workflows/test.yml:19 (does cancelling a superseded run also drop its jobs waiting in a job-level queue?) has no reply yet.

CI Status

• cargo fmt: PASS (required)
• cargo test: PASS (required)
• format-docs: PASS (required)
• format-typescript: PASS (required)
• CI Node pin guard: FAIL (runs the concurrency guard; see above)
• CLAUDE.md symlink guard: PASS
• docs-proposal scripts: PASS
• ts dev lint domains (changed lines): PASS
• vitest: PASS
• cargo test (axum native): PASS
• cargo test (cross-adapter parity): PASS
• cargo test (ts CLI, native) (ubuntu-latest): PASS
• cargo test (ts CLI, native) (macos-latest): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• HTML EOF runtime (Fastly): PASS
• prepare integration artifacts: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• browser integration tests: PASS
• trace runtime and browser acceptance: PASS
• PBS Terraform and Compose checks: PASS
• CodeQL: PASS
• Analyze (actions): PASS
• Analyze (javascript-typescript): PASS (both runs)
• Analyze (python): PASS
• Analyze (rust): PASS

[aram356]

🔧 wrench — Moving the guard here took it off a required check. In round 2 it ran inside format-rust (cargo fmt), one of the four checks main's ruleset requires: cargo fmt, cargo test, format-docs and format-typescript. CI Node pin guard is not one of them. This PR shows the effect: the guard fails on the current merge ref (see the review body) and nothing stops the merge button.

Either of these restores it:

• Move the three steps (Install yq, the node test and this step) back into format-rust. It already sets up the .tool-versions Node ("Use Node.js for the TSJS build"), so the node test can run there.
• Or have a maintainer add CI Node pin guard to the ruleset's required checks. That also covers Set up pinned Node in Rust CI jobs and drop unused tsjs deps #1257's Node pin guard, which has the same gap today.

If the steps stay in this job, its name should change too, since it now runs two guards.

[aram356]

🔧 wrench — This downloads and runs a binary without checking it. It's the only raw binary download in the repo's workflows, and it runs on main pushes too, where (as docs-proposal.yml notes) code can write main-scoped caches that other jobs restore. A replaced or compromised release asset would run with this job's token.

This pins the asset by SHA-256. The value is the v4.54.1 release manifest's yq_linux_amd64 entry, and it matches the asset itself. Verified in Docker: the real asset passes sha256sum --check, and a tampered download fails before chmod and before the binary reaches PATH.

A simpler alternative is to delete the step: the ubuntu-latest (26.04) and ubuntu-24.04 runner images both ship yq 4.54.1 already, and the script fails loudly if yq is missing.

Suggested change

	- name: Install yq
	shell: bash
	run: |
	curl --fail --location --silent --show-error \
	https://github.com/mikefarah/yq/releases/download/v4.54.1/yq_linux_amd64 \
	--output "$RUNNER_TEMP/yq"
	chmod +x "$RUNNER_TEMP/yq"
	echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
	# Pin the yq binary by checksum, so a replaced release asset cannot run in
	# CI with this job's token.
	- name: Install yq
	shell: bash
	run: |
	curl --fail --location --silent --show-error \
	https://github.com/mikefarah/yq/releases/download/v4.54.1/yq_linux_amd64 \
	--output "$RUNNER_TEMP/yq"
	echo "8e34fc298390875de416e6a4afcb8cabeceb25d9aa8506c1a2f9353cf702ea5f $RUNNER_TEMP/yq" | sha256sum --check --strict
	chmod +x "$RUNNER_TEMP/yq"
	echo "$RUNNER_TEMP" >> "$GITHUB_PATH"

[aram356]

♻️ refactor — timeout-minutes accepts an expression with the matrix context, and this regex rejects it. That's what the module stack's Windows axum leg needs once it rebases (your reply on the round-1 thread put the Windows value in those PRs), for example ${{ matrix.os == 'windows-latest' && 65 || 30 }}. This accepts ${{ … }} values and still rejects 0, a missing timeout and a non-numeric string. Verified on fixtures for all four cases; the 7 existing tests pass. A test for the expression case would pin it.

Suggested change

	if [[ ! "$timeout" =~ ^[1-9][0-9]*$ ]]; then
	if [[ ! "$timeout" =~ ^[1-9][0-9]*$ && "$timeout" != '${{ '*' }}' ]]; then

[aram356]

♻️ refactor — The tests miss six of the script's checks. Mutating one check at a time, these mutants pass all 7 tests:

• dropping the workflow-level cancel-in-progress check
• dropping the workflow-level queue: max ban
• dropping string-form on: pull_request detection
• dropping list-form on: [push, pull_request] detection
• dropping the non-matrix extra-segment check
• dropping matrix-key validation

The four tests below kill all six. With them, 11/11 pass, and the file stays clean under docs/.prettierrc. The two other survivors are equivalent: the uses skip at line 141 can't fire because the loop's yq query already filters those jobs (one of the two can go), and a copied group without the prefix check still fails through the extra-segment check.

Suggested change

	})
	})
	test('requires cancellation and rejects queue max on the workflow block', () => {
	withFixture(({ root, workflowsPath }) => {
	const formatPath = path.join(workflowsPath, 'format.yml')
	const source = workflow('format-rust', authorGroup('format-rust'))
	writeFileSync(
	formatPath,
	source.replace('cancel-in-progress: true', 'cancel-in-progress: false')
	)
	assertRejected(root, /workflow concurrency group/)
	writeFileSync(
	formatPath,
	source.replace(
	'cancel-in-progress: true',
	'cancel-in-progress: true\n queue: max'
	)
	)
	assertRejected(root, /workflow concurrency group/)
	})
	})
	test('checks workflows with string and list pull_request triggers', () => {
	withFixture(({ root, workflowsPath }) => {
	const formatPath = path.join(workflowsPath, 'format.yml')
	const source = workflow('format-rust', authorGroup('format-rust'), {
	timeout: false,
	})
	writeFileSync(
	formatPath,
	source.replace('on:\n pull_request:', 'on: pull_request')
	)
	assertRejected(root, /timeout-minutes/)
	writeFileSync(
	formatPath,
	source.replace('on:\n pull_request:', 'on: [push, pull_request]')
	)
	assertRejected(root, /timeout-minutes/)
	})
	})
	test('rejects an extra segment in a non-matrix job group', () => {
	withFixture(({ root, workflowsPath }) => {
	const formatPath = path.join(workflowsPath, 'format.yml')
	writeFileSync(
	formatPath,
	workflow('format-rust', authorGroup('format-rust', 'extra'))
	)
	assertRejected(root, /must not add a shared queue segment/)
	})
	})
	test('rejects a matrix segment that is not a plain matrix value', () => {
	withFixture(({ root, workflowsPath }) => {
	const formatPath = path.join(workflowsPath, 'format.yml')
	const segment = '$' + "{{ matrix.os || 'linux' }}"
	writeFileSync(
	formatPath,
	workflow('format-rust', authorGroup('format-rust', segment), {
	matrix: true,
	})
	)
	assertRejected(root, /matrix job/i)
	})
	})

[aram356]

🌱 seedling — This accepts any non-empty run of ${{ matrix.<key> }}- segments, so a job with an os × node matrix keyed on matrix.os alone passes, and legs that share an OS would queue behind each other. AGENTS.md gate 14 says matrix jobs include their matrix values. No current job has a two-dimension matrix, so this only matters later; comparing the keys used here with strategy.matrix | keys (minus include/exclude) would close it.