fix(ci): reconcile Runtime coverage serialization with current main

[seonghobae]

RCA

Exact protected main@80dabf1a9627a0b64a405e801a9ae083ed4f0189 still runs Runtime CI with three concurrent hosted-runner jobs. Fresh open-PR evidence shows current exact-head Runtime CI, Security, SAST, SBOM, and provenance runs repeatedly remaining queued before repository steps execute. The first actionable repository-owned boundary is hosted-runner demand amplification, not a failing product test.

Historical landing lane #288 already developed and reviewed the narrow remedy, but its branch is rooted at stale protected ancestry. Before this reconciliation, .github/workflows/ci.yml and tests/ci_contract.rs on current protected main were byte-identical to #288's original base, while tests/ci_serial_coverage_contract.rs was absent. This replacement therefore reapplies only the reviewed three-file delta onto current main without force-push or destructive rebase.

TDD / lineage

• RED 64129e913c569519ebacd9c6e2a3b661bfd8adb1 adds the capacity-aware serialization contract while protected-main Runtime CI is still concurrent.
• RED 8f7d3f2a11568b28cda3fbbba404a8703fbc937f binds the broader CI contract to preserved check identities, serialized coverage scheduling, and scoped coverage-generation diagnostics.
• GREEN 19d385475cf2bcdda248f246dd2b81fe3b2f17da applies the exact reviewed fix(ci): serialize Runtime coverage without renaming checks #288 Runtime-CI workflow blob.

Behavior

• Preserve the long-lived Format, lint, test, and rustdoc, Production line coverage, and Production branch coverage check identities.
• Keep rust-quality and line coverage eligible to run concurrently, but serialize branch coverage behind line coverage, reducing Runtime CI peak hosted-runner demand from three jobs to two.
• Use always() && !cancelled() so a line-coverage failure still hands off to branch coverage while cancellation does not allocate another runner.
• Preserve exact-head checkout, no persisted checkout credentials, digest-pinned PostgreSQL, per-run ephemeral database credentials, stable 1.97.1 line coverage, pinned nightly branch coverage, and exact 100% coverage gates.
• Distinguish coverage generation failures from actual incomplete-coverage failures in operator diagnostics.

Boundary

Repository CI scheduling only. No product runtime, psychometric arithmetic, migration, authorization, security/privacy, dependency ownership, release threshold, or required check identity is weakened.

Supersession

This is the current-main replacement for stale #288. Historical checks/reviews on #288 do not transfer. Close #288 once this replacement is confirmed open at the unchanged exact head; do not keep competing CI writer lanes.

Acceptance

Do not merge until this unchanged exact head passes Runtime CI, Security Scan, SAST Semgrep, SPDX SBOM evidence, supply-chain provenance, every live required organization workflow, has zero valid unresolved findings, and satisfies the live independent review requirement. Pending, queued, skipped, cancelled, absent, stale, predecessor, synthetic, or model-only evidence is not passing. Never use administrator bypass.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 12 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2e0c7c15-749f-4a0d-b1cc-b19a22354d42

📥 Commits

Reviewing files that changed from the base of the PR and between 09534ef and 0159939.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• tests/ci_contract.rs
• tests/ci_serial_coverage_contract.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.