Make preflight checks the root of the PR builder job graph

[DonOmalVindula]

Purpose

Today every root job in the PR Builder is dispatchable at once, so a run asks for ~8 runners simultaneously and which one starts first is down to luck in the shared runner pool. Preflight Checks (~20s: pnpm audit, dependency review, docs/PowerShell detection) frequently sits at "Expected - Waiting for status to be reported" while the 15-minute Console App Tests is already burning a runner, and when preflight does fail, everything else has already run to completion.

This makes Preflight Checks the root of the job graph, so it both starts first and gates everything else.

Follow-up to #4269. Refs #4268.

Approach

• needs: [preflight] added to the eight root jobs: verify-mocks, lint, build, test-backend-unit, test-frontend-packages, test-frontend-gate-app, test-frontend-console-app, build_samples. Everything else already reaches preflight transitively, so the only job left ungated is codecov-merge-queue-status, which is a merge-queue-only status stamp that must not wait behind anything.
• Preflight now also runs on workflow_dispatch, which keeps the gating condition on every dependent job unchanged (no always() or result-juggling needed: plain needs semantics do the right thing). Its two diff-based steps, paths-filter and dependency review, are skipped on dispatch because they need a base/head pair that a manual dispatch does not carry; the pnpm audit does run, which is a small improvement over dispatch runs skipping it entirely today.
• build-docs and validate-windows dropped their always() && prefix. With it, a preflight that failed after the filter step could still let them run; without it, they run only when preflight succeeded and the relevant paths changed.

Effect

• At t=0 a run requests 1 runner instead of 8, so preflight reliably gets a slot immediately and finishes in ~20s. The heavy fan-out then requests slots together. Smaller instantaneous footprint per run also plays better with the shared pool when several PRs are active.
• A failing preflight (high-severity CVE, denied license) now skips the entire pipeline instead of letting ~60 runner-minutes complete first.
• Cost: roughly 30-60s added to a green run's wall clock (preflight's ~20s plus one scheduling hop). The pipeline stays bounded by Console App Tests at ~15 min, so this does not move the critical path.

Behavior is otherwise unchanged: the trigger-pr-builder label gate, merge queue runs, and required checks all work exactly as before.

Related Issues

• Refs Reduce PR Builder and merge queue turnaround time #4268

Related PRs

• Follow-up to Speed up PR builder with pnpm/turbo caching, job consolidation, and parallel E2E workers #4269

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• CI/CD Improvements
  • Added support for manually triggered workflow runs.
  • Improved job sequencing and preflight validation for more reliable execution.
  • Prevented pull request–specific checks from running during manual dispatches.
  • Tightened documentation and Windows validation job conditions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a4c2524-1a07-4dbf-aa89-b9b6dc68691d

📥 Commits

Reviewing files that changed from the base of the PR and between f1eac8d and bca24f9.

📒 Files selected for processing (1)

• .github/workflows/pr-builder.yml

---

📝 Walkthrough

Walkthrough

The pull-request builder workflow now supports manual dispatch, skips diff-dependent checks during manual runs, synchronizes downstream jobs with preflight, and directly gates documentation and Windows validation on preflight outputs.

Changes

Workflow gating

Layer / File(s)	Summary
Manual dispatch preflight handling .github/workflows/pr-builder.yml	preflight includes workflow_dispatch; docs/PowerShell change detection and dependency review skip manual runs.
Preflight job synchronization .github/workflows/pr-builder.yml	Verification, lint, build, test, frontend, and sample jobs now depend on preflight.
Preflight output gating .github/workflows/pr-builder.yml	build-docs and validate-windows use direct preflight output conditions without always().

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• thunder-id/thunderid#4269: Updates related preflight-based workflow gating for documentation and Windows checks.
• thunder-id/thunderid#4292: Modifies related workflow job and change-detection conditions.
• thunder-id/thunderid#4319: Adjusts gating conditions across the same workflow paths.

Suggested reviewers: brionmario, thamindudilshan, malith-19, jayashakthi97, udes hathu korala

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: making preflight the root of the PR builder job graph.
Description check	✅ Passed	The description follows the template and includes Purpose, Approach, Related Issues, Related PRs, Checklist, and Security checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!