From 2e643d8081e278839b1881159972775810862d37 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 26 Sep 2026 20:24:18 -0700
Subject: [PATCH] fix(ci): cancel superseded pull request runs

The concurrency groups included the commit SHA, so every run was in a
group of its own and cancel-in-progress never cancelled a run that a
newer push had replaced. Group runs by pull request or ref instead.
Only pull request runs are cancelled, so every push to main still gets
fully checked and published.
---
 .github/workflows/ci-actions.yml | 5 +++--
 .github/workflows/ci-code.yml    | 5 +++--
 .github/workflows/codeql.yml     | 5 +++--
 .github/workflows/publish.yml    | 5 +++--
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci-actions.yml b/.github/workflows/ci-actions.yml
index 5bf83fa..8e6585f 100644
--- a/.github/workflows/ci-actions.yml
+++ b/.github/workflows/ci-actions.yml
@@ -12,8 +12,9 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
-  cancel-in-progress: true
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  # Only cancel superseded pull request runs, so every push to main is fully checked.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   zizmor:
diff --git a/.github/workflows/ci-code.yml b/.github/workflows/ci-code.yml
index 3d929de..209c010 100644
--- a/.github/workflows/ci-code.yml
+++ b/.github/workflows/ci-code.yml
@@ -12,8 +12,9 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
-  cancel-in-progress: true
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  # Only cancel superseded pull request runs, so every push to main is fully checked.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   rustfmt:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9647df9..fcd66de 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -14,8 +14,9 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
-  cancel-in-progress: true
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  # Only cancel superseded pull request runs, so every push to main is fully checked.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   analyze:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a95350f..6e8d541 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,8 +12,9 @@ permissions:
   contents: read # Needed to checkout the repository.
 
 concurrency:
-  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.sha }}"
-  cancel-in-progress: true
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  # Only cancel superseded pull request runs, so every push to main is fully checked.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   artifacts: