ci: make cancelling the native pipeline actually stop it

Clicking "Cancel workflow" appeared to do nothing for minutes. The reason is
that `if: always()` is exempt from cancellation by design: a step or job with
always() keeps running (and a job with it can even start) after the run is
cancelled. The pipeline used always() in eleven places, including every upload
inside archive-test-results — so on cancel each of the ~10 in-flight shards
first uploaded five artifact sets nobody was waiting for.

Replaced all of them with `!cancelled()`, which is equivalent for the cases we
care about — it is true on success AND on failure, so failing shards still
archive their screenshots/logs/videos/diffs, and jobs with skipped
dependencies still run — but is false on cancellation. A shard that trips
timeout-minutes is not "cancelled" in this sense, so timeout artifacts survive.

Not fixed here: the maestro bash harness does not trap SIGINT/SIGTERM, so a
shard mid-flow still runs to the runner's force-kill. Cancellation is much
faster, not instant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: YogendraShelke

.github/actions/archive-test-results/action.yaml

@@ -12,20 +12,24 @@ inputs:
     required: false
     default: ${{ github.workspace }}
 
+# Every step below is `if: ${{ !cancelled() }}` rather than `if: always()`. Both still run
+# when the test step failed — which is the case we need these artifacts for — but always()
+# is exempt from cancellation, so cancelling a run left each shard uploading five artifact
+# sets before it could die, which is why "Cancel workflow" appeared to do nothing.
 runs:
   using: composite
   steps:
     - name: Archive runtime logs
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-runtime-logs-${{ inputs.test-type }}
         path: log/*.log
         if-no-files-found: ignore
 
     - name: Archive test screenshots
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-screenshots-${{ inputs.test-type }}
         path: ${{ inputs.workspace-path }}/maestro/images/actual/${{ inputs.platform }}/**/*.png
@@ -38,7 +42,7 @@ runs:
       # resolves the diff name against the baseline's own relative path. That nested location
       # was never matched by the screenshots glob above, so diffs were silently lost. Gather
       # any *_diff.png from wherever it landed into one flat dir for upload.
-      if: always()
+      if: ${{ !cancelled() }}
       shell: bash
       run: |
         dest="${{ inputs.workspace-path }}/maestro/images/diff/${{ inputs.platform }}"
@@ -49,15 +53,15 @@ runs:
 
     - name: Archive screenshot diffs
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-diffs-${{ inputs.test-type }}
         path: ${{ inputs.workspace-path }}/maestro/images/diff/${{ inputs.platform }}/*.png
         if-no-files-found: ignore
 
     - name: Archive artifacts
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-artifacts-${{ inputs.test-type }}
         path: packages/pluggableWidgets/**/artifacts/
@@ -68,7 +72,7 @@ runs:
     # empty and the upload is a no-op (if-no-files-found: ignore).
     - name: Archive failure videos
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7
-      if: always()
+      if: ${{ !cancelled() }}
       with:
         name: ${{ inputs.platform }}-videos-${{ inputs.test-type }}
         path: maestro/videos/*.mp4

.github/workflows/NativePipeline.yml

@@ -418,7 +418,7 @@ jobs:
     runs-on: ubuntu-26.04
     # Skip this job if we're using artifacts from a specific run; the native bundles now come
     # from the project job (deploy + native-packager), so gate on project success.
-    if: ${{ github.event.inputs.LOCAL_TEST_ARTIFACT_RUN_ID == '' && always() && (needs.project.result == 'success') }}
+    if: ${{ github.event.inputs.LOCAL_TEST_ARTIFACT_RUN_ID == '' && !cancelled() && (needs.project.result == 'success') }}
     steps:
       - name: Debug branch value
         run: echo "Using branch ${{ needs.determine-nt-version.outputs.nt_branch }}"
@@ -535,7 +535,7 @@ jobs:
     runs-on: macos-26
     # Skip this job if we're using artifacts from a specific run; the native bundles now come
     # from the project job (deploy + native-packager), so gate on project success.
-    if: ${{ github.event.inputs.LOCAL_TEST_ARTIFACT_RUN_ID == '' && always() && (needs.project.result == 'success') }}
+    if: ${{ github.event.inputs.LOCAL_TEST_ARTIFACT_RUN_ID == '' && !cancelled() && (needs.project.result == 'success') }}
     steps:
       - name: "Check out Native Template for Native Components Test Project"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -647,7 +647,7 @@ jobs:
   android-widget-tests:
     needs: [scope, mendix-version, project, android-app, android-avd-cache]
     # Run if widgets need testing (widgets_to_test is not empty) and project succeeds
-    if: ${{ needs.scope.outputs.widgets_to_test != '[]' && always() && needs.project.result == 'success' && (needs.android-app.result == 'success' || needs.android-app.result == 'skipped') }}
+    if: ${{ needs.scope.outputs.widgets_to_test != '[]' && !cancelled() && needs.project.result == 'success' && (needs.android-app.result == 'success' || needs.android-app.result == 'skipped') }}
     runs-on: ubuntu-26.04
     # 30 min hard cap per widget shard. A healthy widget's flows run in ~30s each; the cap is a
     # backstop for genuinely wedged shards. Bumped 20→30 after a run where shards were cancelled
@@ -731,12 +731,11 @@ jobs:
             bash maestro/run_maestro_widget_tests.sh android "${{ matrix.widget }}" || [ "$UPDATE_BASELINES" = "true" ]
       
       - name: Archive test results
-        # always(): the test step exits non-zero on a failing shard, which would otherwise
+        # !cancelled(): the test step exits non-zero on a failing shard, which would otherwise
         # SKIP this step — i.e. we'd capture screenshots/logs/videos for green shards but NOT
-        # for the failing ones we actually need to debug. Run regardless of test outcome.
-        # !cancelled() rather than always(): always() is exempt from cancellation, so a
-        # cancelled run still uploaded five artifact sets per shard before it would die.
-        # This still covers pass AND fail (the cases whose artifacts we want).
+        # for the failing ones we actually need to debug. This covers pass AND fail, but
+        # unlike always() it is NOT exempt from cancellation, so a cancelled run stops here
+        # instead of first uploading five artifact sets per shard.
         if: ${{ !cancelled() }}
         uses: ./.github/actions/archive-test-results
         with:
@@ -746,7 +745,7 @@ jobs:
   ios-widget-tests:
     needs: [scope, mendix-version, project, ios-app]
     # Run if widgets need testing (widgets_to_test is not empty) and project succeeds
-    if: ${{ needs.scope.outputs.widgets_to_test != '[]' && always() && needs.project.result == 'success' && (needs.ios-app.result == 'success' || needs.ios-app.result == 'skipped') }}
+    if: ${{ needs.scope.outputs.widgets_to_test != '[]' && !cancelled() && needs.project.result == 'success' && (needs.ios-app.result == 'success' || needs.ios-app.result == 'skipped') }}
     runs-on: macos-26
     # 30 min per widget shard, matching android-widget-tests. iOS needs the budget more than
     # Android: sim cold-boot + Maestro driver startup + runtime-ready wait eat several minutes
@@ -818,7 +817,7 @@ jobs:
   android-js-tests:
     needs: [scope, mendix-version, project, android-app, android-avd-cache]
     # Run if JS actions changed and project succeeds and either android-app succeeds OR we're using custom artifacts (android-app was skipped)
-    if: ${{ needs.scope.outputs.js_actions_changed == 'true' && always() && needs.project.result == 'success' && (needs.android-app.result == 'success' || needs.android-app.result == 'skipped') }}
+    if: ${{ needs.scope.outputs.js_actions_changed == 'true' && !cancelled() && needs.project.result == 'success' && (needs.android-app.result == 'success' || needs.android-app.result == 'skipped') }}
     runs-on: ubuntu-26.04
     timeout-minutes: 90
     steps:
@@ -900,7 +899,7 @@ jobs:
   ios-js-tests:
     needs: [scope, mendix-version, project, ios-app]
     # Run if JS actions changed and project succeeds and either ios-app succeeds OR we're using custom artifacts (ios-app was skipped)
-    if: ${{ needs.scope.outputs.js_actions_changed == 'true' && always() && needs.project.result == 'success' && (needs.ios-app.result == 'success' || needs.ios-app.result == 'skipped') }}
+    if: ${{ needs.scope.outputs.js_actions_changed == 'true' && !cancelled() && needs.project.result == 'success' && (needs.ios-app.result == 'success' || needs.ios-app.result == 'skipped') }}
     runs-on: macos-26
     timeout-minutes: 90
     steps:
@@ -963,9 +962,11 @@ jobs:
   # sources after a successful merge, leaving just the combined artifacts.
   aggregate-test-results:
     needs: [android-widget-tests, ios-widget-tests, android-js-tests, ios-js-tests]
-    # Run even when shards fail/cancel — the failing shards are exactly the ones whose
-    # screenshots/logs we want to inspect.
-    if: ${{ always() }}
+    # Run even when shards fail or time out — those are exactly the ones whose
+    # screenshots/logs we want to inspect. !cancelled() rather than always() so an
+    # explicitly cancelled run isn't held open merging artifacts nobody asked for
+    # (a shard that hits timeout-minutes does not make cancelled() true).
+    if: ${{ !cancelled() }}
     runs-on: ubuntu-26.04
     # The workflow-level block grants only packages:write, so every other scope defaults to
     # none. This job needs contents:read (to check out the triage script) and actions:read