Cancel superseded pull request checks

[rdimitrov]

Summary

Successive updates to a pull request currently leave superseded checks consuming runners. Add workflow-level concurrency to all seven PR entrypoints so a replacement run cancels earlier runs of that workflow for the same PR.

Each entrypoint uses a distinct file-specific prefix and the PR number. Non-PR events use the run ID and disable cancellation, keeping manual runs, scheduled scans, and main/release workflows independent.

Type of change

• Bug fix

Test plan

• Manual testing: ran actionlint 1.7.12 through a temporary Task task on all seven changed workflows, with the repository's runner labels configured. Workflow syntax and expressions passed with ShellCheck disabled.
• Compared full actionlint diagnostics against the unchanged HEAD versions: existing ShellCheck warnings in lifecycle E2E and API compatibility are identical; no new diagnostics.
• Ran git diff --check and independent code review; no required fixes.
• Verified cancellation on this PR with two successive empty commits (66183315e then 9c7c65c6d). All six unfinished workflows for the first commit completed as cancelled; the API no-op had already succeeded. The latest commit started its replacement workflows, and the two API workflows did not cancel one another.
• Latest replacement CI suite completes; independently exercise another PR and manual dispatch.

Changes

File	Change
run-on-pr.yml	Cancel superseded PR Checks, including called validation workflows
security-scan.yml	Cancel direct PR scans; preserve other event runs
test-e2e-lifecycle.yml	Cancel superseded lifecycle runs
renovate-config-validation.yml	Cancel PR validation; preserve main/manual runs
pr-size-labeler.yml	Cancel superseded label calculations
api-compat.yml	Cancel superseded compatibility checks with a dedicated key
api-compat-noop.yml	Cancel superseded companion checks with a separate key

Implementation plan

Approved implementation plan

Add cancellation only at the seven independently triggered PR workflow entrypoints. Group by a distinct workflow identifier and PR number, use a run-ID fallback, and restrict cancellation to pull_request events. Keep reusable children free of duplicate concurrency groups. Validate workflow syntax and obtain code review before opening a draft PR. Handle API compatibility consolidation and main validation/publishing separation in separate changes.

Special notes for reviewers

The API compatibility workflows share a display name, so their concurrency keys deliberately use distinct literal prefixes. Reusable children must not duplicate the caller's concurrency group.

Cancellation requires a replacement workflow to trigger; path-filtered workflows can still finish an older run if a later update no longer matches their filters. Runtime cancellation was verified with successive pushes on this PR; latest-run completion and cross-PR/manual-dispatch isolation remain to be verified.

Runtime cancellation evidence

Workflow	Superseded run	Replacement run
PR Checks	Cancelled	Latest
Security Scan	Cancelled	Latest
E2E Tests Lifecycle	Cancelled	Latest
Renovate Config Validation	Cancelled	Latest
PR Size Labeler - Calculate	Cancelled	Latest
API Compatibility (real)	Cancelled	Latest

The original PR Checks run was also cancelled by the first validation push. The API no-op completed before replacement, so its cancellation was not exercised. Both validation commits are empty and leave the file diff unchanged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.67%. Comparing base (c4f6cb4) to head (5a6d468).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6533      +/-   ##
==========================================
- Coverage   78.67%   78.67%   -0.01%     
==========================================
  Files         777      777              
  Lines       76686    76686              
==========================================
- Hits        60334    60330       -4     
- Misses      16347    16351       +4     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.