[mbianchidev]

Changes

• Give Pages validation a per-PR concurrency group and cancel superseded runs. Keep production's existing pages group serialized and non-interruptible.
• Cancel obsolete CodeQL runs only within the same PR. Push and scheduled scans remain independent, with both Actions and JavaScript/TypeScript analyses intact.
• Install Chromium's headless shell only, retaining Linux system dependencies and all 44 desktop/mobile interaction tests.
• Update the existing contributor instructions. No trigger/path filters, test selection, scan scope, permissions, repository settings, or deployment artifact sources change.
• Refresh only the transitive Zod lockfile entry to 4.6.7. The required locked install exposed GHSA-mrhx-c7xc-m3w5 in the ESLint toolchain; the compatible update clears the audit finding without changing direct dependencies.

Performance evidence

Baseline: three recent successful PR runs (1, 2, 3). First optimized sample: this PR's Pages run, on Node.js 22.23.3 and Ubuntu 24.04.

Metric	Baseline median	First optimized PR run
Pages workflow elapsed	63s	56s
Build job elapsed	59s	54s
Browser setup	22s	16.3s
Browser test inventory	44	44

The latest baseline main run downloaded an unused 191.1 MiB full Chromium archive. The optimized Linux run downloads only headless shell and FFmpeg, eliminating that payload without changing browser projects or assertions.

These are observations from one optimized run, not a controlled benchmark. Queue-isolation and obsolete-run cancellation savings are unmeasured. Production deployment serialization is deliberately retained. The public repository's timing API reports zero billable runner milliseconds, so no billing savings are claimed.

No end-to-end CI improvement is claimed: CodeQL runner logs finished at 16:48:21/16:48:36 UTC, but GitHub published successful job completion only at 16:58:52/16:57:11 UTC. Metadata requests intermittently returned HTTP 502 during that delay. Both analyses ultimately passed; their uploaded results for this PR's merge revision contain no errors or warnings.

Validation and current status

• Locked npm ci: succeeds; audit reports zero vulnerabilities.
• All 20 unit tests, ESLint and the production build pass.
• All 44 desktop/mobile interaction tests pass with two workers, locally using an isolated directory containing only headless shell and FFmpeg, and again on Linux CI.
• actionlint for both workflows and git diff --check pass. Changes were reviewed locally before pushing.
• Current-head Pages validation, both CodeQL analysis jobs and the CodeQL result check are green. Deployment is skipped as intended for a PR.
• No unresolved review threads or submitted reviews. The PR remains draft; repository policy does not request automatic review on drafts, and human review is still required.

Notices: GitHub announces the ubuntu-latest migration to Ubuntu 26; the validated run still used Ubuntu 24.04. Local Node.js 26/npm 11.20 emits an optional macOS fsevents install-script approval warning, absent from Linux CI. No runner or install-script policy was changed.

[Copilot]

🟢 Approval recommended

The scoped changes preserve test and scan coverage and production behavior, with successful CI validation and no unresolved findings.

No open issues 🎉

What changed in this PR

This PR reduces redundant CI work and browser setup time while preserving validation coverage and production deployment serialization.

Changes:

• Isolate Pages validation by PR and cancel superseded Pages and CodeQL PR runs.
• Install only Chromium’s headless shell and update contributor instructions.
• Refresh the transitive Zod dependency to address the reported audit finding.

File	Description
package-lock.json	Updates transitive Zod to 4.6.7.
CONTRIBUTING.md	Documents headless-shell setup and workflow concurrency behavior.
.github/​workflows/​deploy.yml	Isolates PR validation and reduces browser downloads while retaining production serialization.
.github/​workflows/​codeql.yml	Cancels superseded PR scans while keeping non-PR scans independent.

_{Review effort: Balanced (auto)}