Skip to content

S-138738: Cancel superseded CI runs on pull requests #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
EllAchE merged 1 commit into from
Sep 13, 2026
Merged

S-138738: Cancel superseded CI runs on pull requests #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/gitleaks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,13 @@ on:
push:
branches: [main]

concurrency:
# A new push to a pull request supersedes the run already in flight, and
# nothing downstream waits on the older one. Push events are exempt: a push
# run is the record that a given commit passed, so it always finishes.
group: ${{ github.workflow }}-${{ github.ref }}

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Exclude push events from the concurrency group

When three or more main pushes arrive before the first run finishes, they all enter this concurrency group. Setting cancel-in-progress to false protects only the running push: GitHub permits at most one running and one pending run per group and replaces an existing pending run when another is queued. The replacement run scans only its own ${{ github.event.before }}..${{ github.sha }} range (lines 54–61), so commits unique to the canceled pending push are never checked for secrets. Make the group unique for push runs while retaining the shared PR-ref group.

Useful? React with 👍 / 👎.

cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
gitleaks:
if: ${{ !contains(github.event.pull_request.labels.*.name, 'no_gha') }}
Expand Down