From 9917e6a5c8cd566aea161f28e4fe911a75082187 Mon Sep 17 00:00:00 2001
From: njord <njord@njords-Mac-mini.localdomain>
Date: Sat, 18 Jul 2026 09:49:02 -0500
Subject: [PATCH] ci: cancel superseded workflow runs on PR pushes

Add a top-level concurrency group (github.workflow + github.ref) to the
push/pull_request workflows that lacked one, cancelling in-progress runs
only for pull_request events. Reduces wasted runner minutes from
superseded PR pushes while staying safe for main/tag deploy paths.

Part of the org CI-cost audit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml                | 4 ++++
 .github/workflows/codeql.yml            | 4 ++++
 .github/workflows/dependency-review.yml | 4 ++++
 .github/workflows/docker.yml            | 4 ++++
 .github/workflows/publish-test.yml      | 4 ++++
 5 files changed, 20 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8fc71ebf..4463bff7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,10 @@ on:
     branches: [main, "pr/gh-*"]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2a87daf5..c5d5e7a7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,6 +9,10 @@ on:
     # Weekly Monday 06:17 UTC — off-peak, off-the-hour to avoid runner contention.
     - cron: "17 6 * * 1"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 59706d4a..4b649b21 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -4,6 +4,10 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 5a97dc93..bc1c0722 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -30,6 +30,10 @@ on:
         required: true
         type: string
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
   packages: write
diff --git a/.github/workflows/publish-test.yml b/.github/workflows/publish-test.yml
index e5380c8d..576a28b9 100644
--- a/.github/workflows/publish-test.yml
+++ b/.github/workflows/publish-test.yml
@@ -21,6 +21,10 @@ on:
   push:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   publish-dev:
     runs-on: ubuntu-latest