fix(ci): stop main web runs from queueing behind unapproved runs

[rickyrombo]

Problem

Web CI on main regularly gets stuck. The workflow-level concurrency group was:

group: web-${{ github.head_ref || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}

On main, head_ref is empty, so every push landed in the same group (web-refs/heads/main), and cancel-in-progress is false for pushes.

A job waiting at the production or release environment approval gate keeps its run in progress for as long as it waits — holding the group. So:

1. Run A parks at the gate, sometimes for days.
2. Run B (next push) sits pending behind it.
3. Run C arrives and evicts B — GitHub keeps only one pending run per group.

Recent main run history shows both halves of this:

Run	Duration	Result
29782124640	107h1m	cancelled (parked at gate)
29532082633	96h50m	cancelled (parked at gate)
29868310076	46h27m	cancelled (parked at gate)
30865573872	22s	cancelled — zero jobs executed
29868296983	12s	cancelled — zero jobs executed

GET /actions/runs/30865573872/jobs returns an empty job list, confirming those short runs never started a single job; they were evicted while pending.

Fix

Fall back to github.run_id instead of github.ref when head_ref is empty, so each main run gets its own concurrency group and runs independently. A run parked at an approval gate can no longer block or evict the next push, and an in-flight deploy is never interrupted.

PR behavior is unchanged: still keyed on the branch, still cancels superseded runs on new commits.

Trade-offs

• main now runs full CI on every push instead of evicting queued runs, so spend rises slightly versus today's broken behavior. The alternative — cancel-in-progress: true on main — would let a new push kill an in-flight production deploy, which is worse.
• Multiple gates can be pending at once, so approving an older run deploys older code. This was already true before this change; a SHA-freshness guard in web-deploy would close it, but that's out of scope here.

identity.yml and sdk.yml use the same github.ref pattern but have no environment gates, so nothing can park there — left unchanged.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: cf65a13

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.