[AlexanderLanin]

Why

on-pr.yml is the main PR-check entry point for all S-CORE repositories, but it fans out into 8 separate jobs from a capability-detection job. For a typical repo this means:

• Skipped-job clutter — a docs repo skips every Bazel job, a Python repo skips every Bazel job, leaving a wall of skipped entries in the PR checks UI.
• Repeated overhead — every job that does run spins up its own runner and re-checks-out the repo, so a handful of ~3-second checks each pay runner spin-up + checkout cost.
• Redundant setup — Bazel is installed three times (in detect-repo-bazel-targets, bazel-format-check, and bazel-copyright-check).

Few maintainers want independent pass/fail feedback from a dozen trivial jobs; a single consolidated result is more useful and much cheaper.

What

Rewrite on-pr.yml as one job whose steps are the individual checks.

Non-stopping, still per-step visible

Every check step is gated if: ${{ !cancelled() && <capability> }}. Because the condition isn't the implicit success(), a failing check does not skip the checks after it — each still shows its own red/green, and the job fails if any step failed. No shell "collect failures and exit at the end" aggregation is needed.

Failures vs. infrastructure

checkout and the detection steps keep the default success() gate. If either fails, the capability outputs are empty, so every <capability> == 'true' guard is false and all checks skip while the job is already red — a broken checkout can't run checks against a missing tree, but a broken check never blocks its siblings.

Nothing heavy installs unless needed

setup-uv and setup-bazel are themselves gated, so a docs-only repo installs neither, and Bazel is set up once — shared by target-detection + format + copyright + lockfile.

Trade-off

Checks now run sequentially in one runner instead of in parallel across runners (for a Bazel repo: format → copyright → lockfile one after another). This is the deliberate cost of eliminating per-job runner spin-up and skipped-job clutter.

Changes

• .github/workflows/on-pr.yml — collapsed 8 jobs into a single pr-checks job; checks gated with !cancelled() && <capability> so failures don't stop siblings.
• Inlined the two bzlmod-lock-check.yml checks (mod tidy + git diff, and mod deps --lockfile_mode=error) and dropped on-pr's internal uses: call. The standalone bzlmod-lock-check.yml is unchanged (still consumed directly by other repos).
• Bazel now set up once and shared across all Bazel checks (was 3× separate setups).
• bazel-module-name-check kept but disabled via the && false idiom (a bare if: false is rejected by actionlint) until its detection script is fixed.
• Preserved the pull_request_target refusal guard (from bzlmod-lock-check.yml) as the first step, now covering the whole job.
• Dropped the unused id-token: write request — no step consumes an OIDC token (sibling Bazel workflows use setup-bazel without it).

Note: scoped to on-pr.yml only. Not yet exercised on a live PR run — the !cancelled() non-stopping behavior and the single shared Bazel setup should be confirmed against a real Bazel repo before rollout.

[MaximilianSoerenPollak]

For me this looks like a good improvement and logical

[AlexanderLanin]

as the old on-pr is barely used, this change can only be an improvement. I'll merge this.