From d2c978404eaf5a30510fd94d7d3460fc6eb77268 Mon Sep 17 00:00:00 2001
From: Jarek Potiuk <potiuk@apache.org>
Date: Tue, 13 Oct 2026 14:32:31 +0100
Subject: [PATCH] ci: cancel superseded pull request runs

A new push to a pull request now cancels the runs still in progress for
its previous commit, in every workflow triggered by pull requests. Runs
on main are grouped by branch but never cancelled, so every merge commit
still gets a complete whole-tree result.

labeler-signal (a two-second no-op that wakes the labeler) and labeler
(which deliberately queues its runs) are left as they are.

Generated-by: Claude Opus 5
---
 .github/workflows/asf-allowlist-check.yml      | 3 +++
 .github/workflows/codeql.yml                   | 4 ++++
 .github/workflows/pre-commit.yml               | 4 ++++
 .github/workflows/rat.yml                      | 4 ++++
 .github/workflows/sandbox-lint.yml             | 4 ++++
 .github/workflows/skill-and-tool-validator.yml | 4 ++++
 .github/workflows/skill-token-count.yml        | 3 +++
 .github/workflows/tests.yml                    | 4 ++++
 .github/workflows/zizmor.yml                   | 4 ++++
 9 files changed, 34 insertions(+)

diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml
index f5b1f8f12..194439241 100644
--- a/.github/workflows/asf-allowlist-check.yml
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -24,6 +24,9 @@ name: "ASF Allowlist Check"
     paths: [".github/**"]
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   asf-allowlist-check:
     runs-on: ubuntu-slim
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index add6aea6b..029fb066f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,6 +30,10 @@ on:  # yamllint disable-line rule:truthy
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     name: "Analyze (${{ matrix.language }})"
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index e8fe8ec7b..b06fcdeea 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -30,6 +30,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   prek:
     # Two shapes of the same job, split by event.
diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml
index 600677aa0..26fb313ea 100644
--- a/.github/workflows/rat.yml
+++ b/.github/workflows/rat.yml
@@ -29,6 +29,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 # Apache RAT (Release Audit Tool) verifies every source file carries an
 # approved licence header — the same check ASF Infra runs on release
 # artefacts, run here on every PR so header drift is caught before merge.
diff --git a/.github/workflows/sandbox-lint.yml b/.github/workflows/sandbox-lint.yml
index 95fb36616..0c1173626 100644
--- a/.github/workflows/sandbox-lint.yml
+++ b/.github/workflows/sandbox-lint.yml
@@ -41,6 +41,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   sandbox-lint:
     name: lint .claude/settings.json against baseline
diff --git a/.github/workflows/skill-and-tool-validator.yml b/.github/workflows/skill-and-tool-validator.yml
index 71d064ffb..dcbc04f6d 100644
--- a/.github/workflows/skill-and-tool-validator.yml
+++ b/.github/workflows/skill-and-tool-validator.yml
@@ -35,6 +35,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   skill-and-tool-validator:
     name: validate skills and tool contracts
diff --git a/.github/workflows/skill-token-count.yml b/.github/workflows/skill-token-count.yml
index cb7368634..8a10951f3 100644
--- a/.github/workflows/skill-token-count.yml
+++ b/.github/workflows/skill-token-count.yml
@@ -42,6 +42,9 @@ on:
     branches: [main]
     paths: *measurement_paths
 permissions: {}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   measure:
     runs-on: ubuntu-slim
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index fba4f789e..f8b494562 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -30,6 +30,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # Discover workspace members from the root pyproject.toml so the
   # pytest matrix below is data-driven — adding a new tool is a
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index dc7949855..bcc371742 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -33,6 +33,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   zizmor:
     name: "zizmor"