From 36266acf29a3ee1ee1babdd9cf881af3889554e6 Mon Sep 17 00:00:00 2001
From: August Cayzer <a@cyzr.me>
Date: Tue, 20 Oct 2026 11:44:36 +0100
Subject: [PATCH] ci(workflows): never cancel a push to main

---
 .github/scripts/ci-changes.test.sh     | 2 ++
 .github/workflows/ci.yml               | 7 +++++--
 .github/workflows/codeql.yml           | 7 +++++--
 .github/workflows/openapi-validate.yml | 7 +++++--
 4 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/.github/scripts/ci-changes.test.sh b/.github/scripts/ci-changes.test.sh
index 056db092..bbc63aad 100644
--- a/.github/scripts/ci-changes.test.sh
+++ b/.github/scripts/ci-changes.test.sh
@@ -64,6 +64,8 @@ check "Build and type-check keeps its name" "$(grep -cF "name: Build and type-ch
 check "the classifier runs in CI" "$(grep -cF "run: bash .github/scripts/ci-changes.sh" "${workflow}")" 1
 check "the classifier's own test runs in CI" "$(grep -cF "run: bash .github/scripts/ci-changes.test.sh" "${workflow}")" 1
 check "no trigger filters paths" "$(grep -cE '^\s+paths(-ignore)?:' "${workflow}")" 0
+check "a push to main gets a group of its own" "$(grep -cF "|| github.run_id }}" "${workflow}")" 1
+check "only a pull request's run is cancelled" "$(grep -cF "cancel-in-progress: \${{ github.event_name == 'pull_request' }}" "${workflow}")" 1
 
 # As CI runs it, against a repository with real commits.
 repo="$(mktemp -d)"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5a8a4683..0cd40231 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,8 +17,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # A push to `main` or a manual run gets a group of its own, so a later push
+  # never cancels the verdict on a commit; only a pull request's run is
+  # superseded.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 07ace349..e6a1d606 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,8 +34,11 @@ on:
     - cron: "41 4 * * 1"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
+  # A draft and a ready pull request have groups of their own, so a draft's
+  # run, queued a moment after the ready one, never cancels it. A push to
+  # `main` gets a group of its own, so a later push never cancels its run.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'pull_request' && format('{0}-{1}', github.ref, github.event.pull_request.draft && 'draft' || 'ready') || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
diff --git a/.github/workflows/openapi-validate.yml b/.github/workflows/openapi-validate.yml
index 180bcad2..e28e3594 100644
--- a/.github/workflows/openapi-validate.yml
+++ b/.github/workflows/openapi-validate.yml
@@ -23,8 +23,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # A push to `main` or a manual run gets a group of its own, so a later push
+  # never cancels the verdict on a commit; only a pull request's run is
+  # superseded.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   validate: