ci: cancel unfinished PR runs when the PR closes

[guapisolo]

Summary

Cancel every unfinished CI run on a PR's head branch the moment the PR closes, merged or not.

Motivation

Merging or closing a PR does not stop its in-flight CI: GitHub cancels a run only when a new run enters the same concurrency group, and closed is not a pr-test.yml trigger. A run started just before merge keeps occupying self-hosted GPU runners to completion — run 29863936642 kept running the full GPU fleet for PR #1584 after it was already merged, delaying every queued PR behind it.

Design

Port cancel-pr-workflows-on-close.yml from sgl-project/sglang, which solved the same problem on the same runner-scarcity grounds:

1. Trigger on pull_request_target: closed so the job holds actions: write even for fork PRs; the job never checks out PR code.
2. List unfinished runs repo-wide by head branch (not per workflow file), so workflows added later are covered without editing this file.
3. Filter by head repository id to spare same-named branches of other forks, and exclude the cancel run itself.
4. Sweep every non-terminal status (queued, in_progress, waiting, pending, requested, action_required), retry listing up to 3 times, force-cancel runs stuck behind approval rules, and run a second pass 20 s later for runs still materializing.

docs/ci/03-cancellation.md (bound via the workflow's doc-dev sentinel) documents the full cancellation model: per-PR supersede in pr-test.yml plus this on-close sweep.

Verification

• Syntax: pre-commit run (check-yaml) passes on both files.
• Logic provenance: the shell step is byte-identical to sglang's production workflow except for the header comments; sglang runs it on every PR close.
• Post-merge check (this trigger only takes effect once the file is on main): push a trivial PR, wait for PR Test to start its GPU stages, merge, then confirm within ~1 min that the leftover run flips to cancelled and a green Cancel PR Workflows on Close run appears for the PR.

Review Focus

• Scrutinize the pull_request_target trigger and the actions: write-only permission block.
• Scrutinize the head-repo-id filter against fork branches named identically to internal ones.
• Scrutinize whether any miles run on a PR head branch must survive PR close (e.g. manually dispatched debugging runs on that branch — they are swept too).

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.