ci: cancel superseded pull request runs

[potiuk]

Summary

• A new push to a pull request now cancels the still-running CI of its previous commit, in the 9 workflows triggered by pull requests (asf-allowlist-check, codeql, pre-commit, rat, sandbox-lint, skill-and-tool-validator, skill-token-count, tests, zizmor). Until now none of them had a concurrency: block, so every push kept all earlier runs going to completion.
• Runs on main (push and the CodeQL schedule) share a per-branch group but are never cancelled, so every merge commit still gets a complete whole-tree result.

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

Type of change

• CI / dev loop (prek, workflows, validators)

Test plan

• prek run --all-files passes
• zizmor --offline --config .zizmor.yml --persona regular .github/workflows/: no findings
• Other: push a second commit to this PR and check that the first commit's runs show as cancelled

Notes for reviewers (optional)

Left unchanged on purpose:

• labeler-signal is a two-second no-op whose only job is to wake labeler via workflow_run; cancelling it saves nothing, and a cancelled run would still wake the labeler.
• labeler deliberately queues its runs (cancel-in-progress: false).
• bump-dev-version and bump-hook-npm-pins run only on dispatch or schedule.

---

Generative AI disclosure: drafted with Claude Code (Claude Opus 5) and reviewed by the author.

🤖 Generated with Claude Code