ci: cancel superseded runs on the five unguarded workflows

[leogdion]

Makes every PR-driven workflow run only on a PR's latest commit. Five workflows had no concurrency block at all, so each re-push left the previous run alive and holding a runner until it finished on its own.

What was piling up

Workflow	Fires on	Cost of a stale run
codeql.yml	every push to every branch (branches-ignore: ['*WIP'])	Swift analysis runs on macos-26 — the scarcest runner class
swift-source-compat.yml	all PRs	3 ubuntu container jobs
claude-code-review.yml	every synchronize	1 job
check-unsafe-flags.yml	main-targeting PRs	1 job
examples.yml	main-targeting PRs	3 ubuntu container jobs

CodeQL was the expensive one: a branch pushed three times held three macOS runners, none of which could be superseded.

MistKit.yml, MistDemo.yml, BushelCloud.yml, and CelestraCloud.yml already cancelled correctly and are untouched.

The change

All five get the branch-keyed group the rest of the repo already uses:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

codeql.yml additionally keys on github.event_name, so its weekly scheduled scan and a push scan of the same branch land in separate groups and cannot cancel each other. Within a single event type, only the newest run of a branch survives.

No trigger filters change. Nothing that was being built, tested, or scanned stops being built, tested, or scanned — the only behavior change is that a superseded run now stops instead of running to completion.

Deliberately left alone

MistDemo-Integration.yml keeps cancel-in-progress: false. It fires only on pushes to main and v*.*.*, never on PRs, so it cannot stack per-PR — and killing it mid-run would leave stray records in the live CloudKit container.

CodeQL's double-fire is not addressed here. On main-targeting PRs it runs twice per commit, once via push and once via pull_request, so those commits still consume two macOS runners. Scoping push to main would fix it — but its pull_request filter is branches: ['main'], so PRs targeting any other base (a v1.0.0-beta.* branch, for instance) would then get no CodeQL coverage at all. That is a coverage decision rather than a cost one, so it's left for a separate discussion.

Verification

Enumerated every workflow's triggers and concurrency config before and after. Before: five workflows reported "no concurrency — piles up." After: every PR-driven workflow reports cancel-in-progress: true, with MistDemo-Integration.yml the only remaining false (deliberate, per above). All 10 root workflow files parse as YAML.

The real proof is behavioral: push twice in quick succession to a PR branch and confirm the first CodeQL run is cancelled rather than left running.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f26ed62b-a109-4a8d-b0b8-9049cd86e72b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (v1.0.0-beta.4@cedc784). Learn more about missing BASE report.

Additional details and impacted files

@@               Coverage Diff                @@
##             v1.0.0-beta.4     #435   +/-   ##
================================================
  Coverage                 ?   74.52%           
================================================
  Files                    ?      158           
  Lines                    ?     3761           
  Branches                 ?        0           
================================================
  Hits                     ?     2803           
  Misses                   ?      958           
  Partials                 ?        0           

Flag	Coverage Δ
spm	74.02% <ø> (?)
swift-6.1-jammy	74.01% <ø> (?)
swift-6.1-noble	74.20% <ø> (?)
swift-6.2-jammy	74.17% <ø> (?)
swift-6.2-noble	74.12% <ø> (?)
swift-6.3-jammy	74.12% <ø> (?)
swift-6.3-noble	74.36% <ø> (?)
swift-6.4-jammy	74.36% <ø> (?)
swift-6.4-noble	74.17% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.