ci: speed up PR validation without reducing coverage

.github/workflows/codeql.yml

@@ -19,6 +19,10 @@ on:
   schedule:
     - cron: '34 20 * * 5'
 
+concurrency:
+  group: codeql-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})

.github/workflows/deploy.yml

@@ -16,11 +16,11 @@ on:
 permissions:
   contents: read
 
-# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
-# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
+# PR validation must not queue behind or cancel production deployments.
+# Production deployments remain serialized and are never interrupted.
 concurrency:
-  group: "pages"
-  cancel-in-progress: false
+  group: ${{ github.event_name == 'pull_request' && format('pages-pr-{0}', github.event.pull_request.number) || 'pages' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # Build job
@@ -46,7 +46,7 @@ jobs:
         run: npm run lint
 
       - name: Install browser for interaction tests
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install --with-deps --only-shell chromium
 
       - name: Build and test desktop and mobile interactions
         run: npm run test:e2e

CONTRIBUTING.md

@@ -61,14 +61,16 @@ npm run lint
 npm test
 
 # Install the browser once, then run desktop and mobile interaction tests
-npx playwright install chromium
+npx playwright install --only-shell chromium
 npm run test:e2e
 ```
 
-The browser tests build the production site and serve it on `127.0.0.1:4179`; that port must be free. On Linux, use `npx playwright install --with-deps chromium` if browser system dependencies are missing. Test output is written to the ignored `test-results/` directory.
+The browser tests build the production site and serve it on `127.0.0.1:4179`; that port must be free. They run headlessly, so only Chromium's headless shell is needed. On Linux, use `npx playwright install --with-deps --only-shell chromium` if browser system dependencies are missing. For headed debugging, install the full browser with `npx playwright install chromium`. Test output is written to the ignored `test-results/` directory.
 
 Roadmap content lives in `src/data/roadmapData.js`. Keep topic IDs stable because shared topic URLs use them. The atlas searches existing content without changing it, and its branch lines represent categories rather than prerequisites.
 
+Pull requests run all checks, including on documentation-only changes. New commits cancel obsolete Pages validation and CodeQL runs for the same pull request, without blocking or canceling other pull requests or production deployments. Push and manual Pages deployments remain serialized and non-interruptible. Push and scheduled CodeQL scans remain independent and analyze both configured languages.
+
 ## Code Style
 
 Please follow the existing code style and conventions used in the project.