Auto-merge gate can silently skip an evaluation: adopt `concurrency.queue: max`

[devantler]

🤖 Generated by the Agentic Engineer

Why

GitHub Actions shipped a queue key for concurrency, and it closes a gap this repo is currently exposed to.

cancel-in-progress: false does not mean "every run eventually executes." It protects the run that is already executing; the run waiting behind it is still discarded when a newer one arrives:

By default, any existing pending job or workflow in the same concurrency group will be canceled and the new queued job or workflow will take its place.

So on a burst of three events in one group, run 1 executes, run 2 is silently cancelled, run 3 executes. There is no failure, no annotation, and nothing in the run list to say a run was dropped.

queue	Meaning
single (default)	"At most one job or workflow run can be pending in the concurrency group."
max	"Up to 100 jobs or workflow runs can be pending in the concurrency group." — FIFO

queue: max with cancel-in-progress: true is a validation error, so it only ever applies where cancelling is already switched off.

Announcement: https://github.com/orgs/community/discussions/12835#discussioncomment-16602100
Reference: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#concurrency

Proven in this org already: devantler-tech/agent-skills has run queue: max in its release.yaml since 2026-07-11, with every Release run green since. This is propagating a fix we have already validated, not a trial.

Why it matters here specifically

.github/workflows/enable-auto-merge.yaml sets a job-level group:

concurrency:
  group: enable-auto-merge-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
  cancel-in-progress: false

The group is per-PR, and this workflow is deliberately triggered by a wide event set — pull_request, pull_request_review, issue_comment, merge_group — precisely so the gate re-evaluates when reviewer results land after the original push. Those events routinely arrive in quick succession on one PR: a synchronize, then a CodeRabbit review, then a Codex result comment.

Under the default queue: single the middle evaluation is cancelled. The file's own comments state the requirement that makes this serious:

any supported reviewer-bot review … every red result must be able to DISARM

A dropped evaluation is therefore not just a missed arming — it can be a missed disarm, leaving a PR armed on evidence that has since been withdrawn. That is a correctness defect in a fail-closed gate.

This is also the highest-leverage instance in the portfolio: this is a reusable workflow consumed across repos, so one fix propagates to every consumer.

What

Add queue: max to the enable-auto-merge job's concurrency block so every triggering event gets its own evaluation, FIFO.

Audit the other workflows in this repo while here — lint.yaml and validate-go-project.yaml use cancel-in-progress: true, which is correct for superseded CI and must stay as-is.

Acceptance criteria

• The enable-auto-merge job carries queue: max; cancel-in-progress: false is retained.
• A burst of PR events on one PR produces one evaluation run per event, none cancelled.
• cancel-in-progress: true workflows are left unchanged.

Part of devantler-tech/monorepo#2453 · Rough size: XS

[coderabbitai]

🔗 Related PRs

#412 - ci: skip the suite on the release-commit push to dodge the self-pin tag race [merged]
#427 - fix: resolve first-party self-references at the same commit [merged]
#575 - fix(auto-merge): harden mutable review evidence [merged]
#594 - fix(validate-go-project): raise govulncheck timeout to survive cold-cache scans [merged]
#599 - fix(auto-merge): complete ineligible required runs [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!