[zelentsov-dev]

Summary

• Update workflow concurrency to cancel superseded runs on pull_request, refs/heads/develop, and refs/heads/main, while preserving isolated non-cancellable runs for release tags (refs/tags/v*), schedule, and workflow_dispatch.
• Add if: github.event_name != 'schedule' to tests and release-contract so the weekly Monday drift cron only runs promotion-lineage and latest-apple-contract on ubuntu-latest without spinning up macos-15 runners.
• Add pinned actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 (v4.2.3) for SwiftPM build and package caches in tests, release-contract, and publish-release, and guard brew install mint behind command -v mint.

[zelentsov-dev]

Protocol: DX-REVIEW/1
Message: REVIEW_RESULT
Round: 2
Repository: zelentsov-dev/asc-mcp
PR: 35
Base-SHA: 852d7df
Head-SHA: f11aaf7
Previous-Reviewed-Head: 9822050
Delta: 9822050..f11aaf7
Change-Class: ci-workflow
Deployment-Authority: no-deploy

Intent and user effect

Speed up CI by caching SwiftPM build/package directories across macOS jobs, skipping macOS test/release-contract jobs on the weekly Monday schedule drift check, and refining workflow concurrency while isolating schedule, workflow_dispatch, and release tag runs.

Scope and exclusions

• .github/workflows/ci.yml (concurrency, tests, release-contract, publish-release)
• Excluded: Swift source code under Sources/ and Tests/
• Excluded: Release publishing logic and OpenAPI drift check scripts

Preserved contracts and invariants

• Fail on release warnings still gates release-contract because actions/cache@v4 only saves cache on job success and any Sources/** or Package.resolved change alters the primary cache key
• publish-release (if: startsWith(github.ref, 'refs/tags/v')) is unaffected by skipping tests and release-contract on schedule events
• Release tags (refs/tags/v*), schedule, and workflow_dispatch runs remain isolated in per-run_id non-cancellable concurrency groups

Risk focus

1. Workflow concurrency expression across pull_request, branch pushes (develop/main), release tags, schedule, and workflow_dispatch (verified fixed in f11aaf7)
2. SwiftPM .build caching interaction with compiler warning detection in release-contract (verified safe: failed jobs do not save cache, and WMO release builds recompile the module when Sources/** changes)

Evidence ledger

Layer	Status	Evidence
source	VERIFIED	Inspected incremental diff 9822050..f11aaf7 and full PR diff 852d7df...f11aaf7 in .github/workflows/ci.yml
local	N/A	CI workflow YAML change only
CI	VERIFIED	Run 40669443709 on f11aaf7: 4/4 checks green (Promotion Lineage 5s, Latest Apple Contract Drift 7s, Tests 4m32s, Release & Apple Contract)
device	N/A	Server-side SwiftPM CLI / CI workflow change
staging	N/A	No staging environment for asc-mcp
provider	N/A	No App Store Connect provider changes
production	N/A	No release tag or production effect

Findings

PR35-F001

• Severity: P2
• Confidence: 0.98
• Blocking: no
• State: CLOSED
• Location: .github/workflows/ci.yml:17-18
• Impact: On schedule and workflow_dispatch events, GitHub Actions sets github.ref to the repository default branch (refs/heads/develop) or the dispatched branch (refs/heads/main or refs/heads/develop). Without gating on github.event_name == 'push', schedule and workflow_dispatch runs joined the branch concurrency group with cancel-in-progress: true.
• Original-Counterexample: Trigger workflow_dispatch on main (or let Monday cron schedule fire when default branch is develop while a push run on develop is running): github.event_name is 'workflow_dispatch' (or 'schedule') and github.ref is 'refs/heads/main' (or 'refs/heads/develop'). Replayed on f11aaf7: (github.event_name == 'push' && (github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main')) now evaluates to false, so group resolves to CI-<run_id> and cancel-in-progress resolves to false.
• Required-Correction: Gate the branch ref check on github.event_name == 'push' in both concurrency.group and concurrency.cancel-in-progress (verified fixed in f11aaf7).
• Follow-Up: Verified fixed in f11aaf7

Verdict

• Patch: APPROVE
• Merge: READY
• Merge-Actor: TEAMLEAD
• Release-Deploy: NOT_ASSESSED
• Production-Authority: OWNER_ONLY
• Approved-Head: f11aaf7
• CI: VERIFIED 4/4 checks green on run 40669443709
• Remaining-Not-Checked: None

Not checked and residual risk

• Not checked: Live schedule trigger execution on GitHub Actions (verified by static expression analysis of github.event_name and github.ref)
• Residual risk: SwiftPM .build cache size growth over time within GitHub Actions 10 GB repository cache eviction policy