From f6c8ee1e85b7ee30a0fdb0ad17d3722211f2fc59 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=98=93=E8=89=AF?= <1204183885@qq.com>
Date: Wed, 24 Jun 2026 18:59:47 +0800
Subject: [PATCH] ci: move macOS/Windows tests and CodeQL off the per-PR path
 (#5813)

These three jobs reran on every PR push but rarely caught push-to-push
regressions: macOS/Windows are the slowest, costliest runners and platform
breakage is rare per iteration, and CodeQL findings seldom change between
pushes. Gate all three off the pull_request event so they no longer sit on
every PR's critical path. They still run on push to main (and in the merge
queue once enabled), so platform and security regressions are still caught
before release. The only required status check, Test (ubuntu-latest, Node
22.x), is unaffected and keeps running on PRs.
---
 .github/workflows/ci.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 73d8313131..e8dbfc0920 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -273,7 +273,12 @@ jobs:
   test_platforms:
     name: 'Test (${{ matrix.os }}, Node ${{ matrix.node-version }})'
     needs: 'classify_pr'
-    if: '${{ !cancelled() }}'
+    # macOS/Windows are the slowest, costliest runners and platform-specific
+    # regressions are rare per push, so rerunning them on every review iteration
+    # is mostly wasted. Skip on PR pushes; they still run on push to `main` (and
+    # in the merge queue, once enabled), catching platform breakage before it
+    # ships without sitting on every PR's critical path.
+    if: "${{ !cancelled() && github.event_name != 'pull_request' }}"
     runs-on: '${{ fromJSON(matrix.runner) }}'
     permissions:
       contents: 'read'
@@ -374,7 +379,10 @@ jobs:
   codeql:
     name: 'CodeQL'
     needs: 'classify_pr'
-    if: "${{ !cancelled() && needs.classify_pr.outputs.skip_ci != 'true' }}"
+    # Security findings rarely change push-to-push, so a slow scan on every PR
+    # push is poor value. Skip on PR pushes; CodeQL still runs on push to `main`
+    # (and in the merge queue, once enabled) as the pre-/post-merge backstop.
+    if: "${{ !cancelled() && needs.classify_pr.outputs.skip_ci != 'true' && github.event_name != 'pull_request' }}"
     runs-on: 'ubuntu-latest'
     # Analysis normally finishes in ~7-9 min (22 min worst case observed). Without
     # an explicit cap, a hosted runner that drops its heartbeat mid-analysis leaves