From 8ad61403018d185c6ca44a9847df534729ac5435 Mon Sep 17 00:00:00 2001
From: Byron Williams <byronawilliams@gmail.com>
Date: Wed, 20 May 2026 21:08:32 -0700
Subject: [PATCH] ci(mutation): drop pull_request trigger, weekly schedule only

Mutation testing is wall-clock expensive (60-minute typical timeout per
run). Wiring it as a PR check inflates merge latency and gates merges on
flaky long-running signal that the weekly cron already covers. The
previous fail-under-threshold expression also silently blocked merges.

Changes:
- Remove pull_request: trigger and concurrency PR-scope
- Remove pull-requests: write permission (no longer posts PR comments)
- Normalize fail-under-threshold to opt-in via workflow_dispatch input
- Add fail_under_threshold workflow_dispatch input (default false)
- Update header to document the policy and reference CI-053

Enforced fleet-wide by manifest check CI-053.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/mutation-testing.yml | 33 +++++++++++++-------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/mutation-testing.yml b/.github/workflows/mutation-testing.yml
index 505a733..1069687 100644
--- a/.github/workflows/mutation-testing.yml
+++ b/.github/workflows/mutation-testing.yml
@@ -1,5 +1,9 @@
 # Mutation Testing for Python Libs
-# Validates test effectiveness by introducing code mutations.
+# Validates test effectiveness by introducing code mutations and checking the
+# test suite catches them. Runs on a weekly cron (report-only) plus manual
+# workflow_dispatch. Not run on PRs: the 60-minute typical timeout outweighs
+# the per-PR signal; weekly drift detection covers regression-spotting.
+# Enforced by manifest check CI-053.
 #
 # This is a thin caller to the org-level reusable workflow.
 #
@@ -7,10 +11,10 @@
 name: Mutation Testing
 
 on:
-  # Weekly schedule - Sundays at 2 AM UTC
+  # Weekly schedule - Sundays at 02:00 UTC (report-only)
   schedule:
     - cron: '0 2 * * 0'
-  # Manual trigger with configurable threshold
+  # Manual trigger with configurable threshold and opt-in failure
   workflow_dispatch:
     inputs:
       mutation_threshold:
@@ -18,35 +22,30 @@ on:
         required: false
         default: '80'
         type: string
-  # Run on PRs that modify source code
-  pull_request:
-    branches: [main, master, develop]
-    paths:
-      - 'src/**/*.py'
-      - 'tests/**/*.py'
-      - 'pyproject.toml'
+      fail_under_threshold:
+        description: 'Fail the run if score is below threshold (default: false)'
+        required: false
+        default: 'false'
+        type: string
 
-# Cancel in-progress runs for same PR/branch
+# Cancel in-progress runs for the same branch
 concurrency:
-  group: mutation-${{ github.event.pull_request.number || github.ref }}
+  group: mutation-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   mutation:
     name: Mutation Testing
-    # Skip on forks (no PR comment permissions)
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@main
     with:
       python-version: '3.12'
       source-directory: 'src'
       test-directory: 'tests'
       mutation-threshold: ${{ github.event.inputs.mutation_threshold && fromJSON(github.event.inputs.mutation_threshold) || 80 }}
-      fail-under-threshold: ${{ github.event_name != 'schedule' }}
-      post-pr-comment: true
+      fail-under-threshold: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.fail_under_threshold == 'true' }}
+      post-pr-comment: false
       timeout-minutes: 60
     secrets: inherit