ci(workflows): never cancel a push to main

.github/scripts/ci-changes.test.sh

@@ -64,6 +64,8 @@ check "Build and type-check keeps its name" "$(grep -cF "name: Build and type-ch
 check "the classifier runs in CI" "$(grep -cF "run: bash .github/scripts/ci-changes.sh" "${workflow}")" 1
 check "the classifier's own test runs in CI" "$(grep -cF "run: bash .github/scripts/ci-changes.test.sh" "${workflow}")" 1
 check "no trigger filters paths" "$(grep -cE '^\s+paths(-ignore)?:' "${workflow}")" 0
+check "a push to main gets a group of its own" "$(grep -cF "|| github.run_id }}" "${workflow}")" 1
+check "only a pull request's run is cancelled" "$(grep -cF "cancel-in-progress: \${{ github.event_name == 'pull_request' }}" "${workflow}")" 1
 
 # As CI runs it, against a repository with real commits.
 repo="$(mktemp -d)"

.github/workflows/ci.yml

@@ -17,8 +17,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # A push to `main` or a manual run gets a group of its own, so a later push
+  # never cancels the verdict on a commit; only a pull request's run is
+  # superseded.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read

.github/workflows/codeql.yml

@@ -34,8 +34,11 @@ on:
     - cron: "41 4 * * 1"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
+  # A draft and a ready pull request have groups of their own, so a draft's
+  # run, queued a moment after the ready one, never cancels it. A push to
+  # `main` gets a group of its own, so a later push never cancels its run.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'pull_request' && format('{0}-{1}', github.ref, github.event.pull_request.draft && 'draft' || 'ready') || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read

.github/workflows/openapi-validate.yml

@@ -23,8 +23,11 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # A push to `main` or a manual run gets a group of its own, so a later push
+  # never cancels the verdict on a commit; only a pull request's run is
+  # superseded.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   validate: