ci: cancel superseded pull request runs

.github/workflows/asf-allowlist-check.yml

@@ -24,6 +24,9 @@ name: "ASF Allowlist Check"
     paths: [".github/**"]
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   asf-allowlist-check:
     runs-on: ubuntu-slim

.github/workflows/codeql.yml

@@ -30,6 +30,10 @@ on:  # yamllint disable-line rule:truthy
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     name: "Analyze (${{ matrix.language }})"

.github/workflows/pre-commit.yml

@@ -30,6 +30,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   prek:
     # Two shapes of the same job, split by event.

.github/workflows/rat.yml

@@ -29,6 +29,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 # Apache RAT (Release Audit Tool) verifies every source file carries an
 # approved licence header — the same check ASF Infra runs on release
 # artefacts, run here on every PR so header drift is caught before merge.

.github/workflows/sandbox-lint.yml

@@ -41,6 +41,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   sandbox-lint:
     name: lint .claude/settings.json against baseline

.github/workflows/skill-and-tool-validator.yml

@@ -35,6 +35,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   skill-and-tool-validator:
     name: validate skills and tool contracts

.github/workflows/skill-token-count.yml

@@ -42,6 +42,9 @@ on:
     branches: [main]
     paths: *measurement_paths
 permissions: {}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   measure:
     runs-on: ubuntu-slim

.github/workflows/tests.yml

@@ -30,6 +30,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # Discover workspace members from the root pyproject.toml so the
   # pytest matrix below is data-driven — adding a new tool is a

.github/workflows/zizmor.yml

@@ -33,6 +33,10 @@ on:  # yamllint disable-line rule:truthy
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   zizmor:
     name: "zizmor"