ci(quality): stop the release PR cancelling every push run on development

[rubenvdlinde]

The defect

concurrency:
  group: quality-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

A push to development has no head ref, so the group renders quality-development.

development also permanently has an open PR — the standing "Release: merge development into beta" — and that PR's head_ref is literally development. Its run renders the same group. cancel-in-progress then kills whichever started first, and that is always the push run: it is created a few seconds earlier.

The push run is the only carrier of the push-only jobs in the shared quality.yml:

job	condition
Coverage Baseline Check	github.event_name == 'push' && ref is main/development
SBOM	ref is main/beta/development
Features Extract	github.event_name != 'pull_request'

On the surviving PR run Coverage Baseline Check reports skipped — which is correct, it is a push-only job on a pull_request event — and a skipped job renders just like a passing one. So the gate appears on both runs and executes on neither. That is the permanently-pending shape of a dead gate, and a cancelled run is no verdict at all.

Fix

The dedup is worth keeping. For a feature branch the push run and the PR run genuinely are the same jobs twice, and cancelling one is the point of the block. It is only wrong for main and development, where the push run is not a duplicate.

trigger	group before	group after
push development	quality-development	quality-development-push
release PR (head development)	quality-development	quality-development
push main	quality-main	quality-main-push
push feature/x	quality-feature/x	quality-feature/x
PR head feature/x	quality-feature/x	quality-feature/x

Feature-branch dedup is untouched, so this adds no CI cost there. It adds one extra run per merge to main/development — the run that was supposed to exist all along.

Precedent

Identical to openconnector#1158, whose proof was that repo's first-ever completed development push run (31048998594), where Coverage Baseline Check, SBOM and Features Extract all executed and reported success.

Verification

Reading the expression is not evidence. The check is end-to-end: after this lands, the development push run must complete rather than be cancelled, and the push-only jobs must execute rather than skip. I will confirm on the merge commit and report the run id. If the push run is still cancelled, this fix is wrong and should be reverted rather than papered over.

Nothing here weakens a gate: no baseline widened, no waiver, no threshold moved, no continue-on-error, no skip.

[github-actions]

Quality Report — ConductionNL/procest @ 6b2449b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-06 05:34 UTC

Download the full PDF report from the workflow artifacts.