chore(ci): add concurrency control to all workflows#133
Merged
Conversation
Adds a top-level `concurrency:` block to every workflow file, per the
org-wide CI Concurrency Hardening brief. Cancels superseded PR runs;
never cancels runs on `main`, tags, releases, or scheduled events.
Classification per workflow:
* ci.yml, bench.yml, fuzz.yml — default variant (cancel-in-progress
conditional on pull_request event_name)
* fixtures.yml — scheduled variant (unique group per run via run_id;
cancel-in-progress: false). Each weekly fixture run is independent
data and must complete.
* release.yml — release variant (group by ref, cancel-in-progress:
false). A cancelled release mid-publish would leave registry / tag
/ attestation state inconsistent.
Note: the brief's canonical pattern is `${{ github.head_ref ||
github.ref }}`. The repo's pre-commit hook flags any expression
referencing `github.head_ref` as a workflow-injection risk. Since
`github.ref` alone is unique per branch (refs/heads/<name>) and per PR
(refs/pull/<N>/merge), and is NOT in the hook's risky-inputs list, we
use `github.ref` here. Grouping is equivalent for both push and
pull_request event types, and the conditional `cancel-in-progress`
still cancels superseded PR runs while preserving main / tag /
schedule / dispatch runs.
Expected effect locally: 30-40% reduction in CI compute and clearing
of any queued superseded jobs once an agent or developer pushes
multiple commits to a PR within minutes.
Out of scope: runner migration, job parallelization, cache strategy
changes, Lean proof splitting, permission minimization (separate
follow-up tickets).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a top-level
concurrency:block to every.github/workflows/*.yml, per the org-wide CI Concurrency Hardening brief. Cancels superseded PR runs; never cancels runs onmain, tags, releases, or scheduled events.Classification
ci.ymlpull_requestbench.ymlfuzz.ymlfixtures.ymlrun_id; never cancel (each weekly run is independent data)release.ymlref; never cancel (mid-publish cancellation would leave registry / tag / attestation state inconsistent)Note on the brief's
head_refpatternThe brief's canonical default pattern is
${{ github.workflow }}-${{ github.head_ref || github.ref }}. The repo's pre-commit hook flags any expression referencinggithub.head_refas a workflow-injection risk (it's in the documented risky-inputs list).This PR uses
github.refalone, which:refs/heads/<name>) and per PR (refs/pull/<N>/merge).pushandpull_requestevents.cancel-in-progress: ${{ github.event_name == 'pull_request' }}, still delivers the brief's stated behavior: cancel superseded PR runs, preserve main / tag / schedule / dispatch runs.Verification plan (per brief §"Verification")
yamllint(viapython -c yaml.safe_load) — clean on all 5 filesmainrun completes normally (not cancelled)Out of scope
Per the brief: runner migration, job parallelization, cache strategy changes, permission minimization. Each tracked separately.