From be26c3d486f088deae707ee4b24900835cf5daee Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 18 May 2026 10:22:58 +0100
Subject: [PATCH] harden(ci): concurrency-cancel guard on canonical check
 workflows

Redistributes the merged hyperpolymath/standards#122 canonical fix:
adds concurrency{cancel-in-progress:true} to read-only check workflows
(and scopes affinescript-verify push to [main,master]) so re-pushes /
rebased PRs do not pile up queued runs against the shared account-wide
Actions concurrency pool. Read-only checks only; zero coverage lost.

Files: scorecard.yml scorecard-enforcer.yml governance.yml codeql.yml secret-scanner.yml echidna-verify.yml

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/codeql.yml             | 8 ++++++++
 .github/workflows/echidna-verify.yml     | 8 ++++++++
 .github/workflows/governance.yml         | 8 ++++++++
 .github/workflows/scorecard-enforcer.yml | 8 ++++++++
 .github/workflows/scorecard.yml          | 8 ++++++++
 .github/workflows/secret-scanner.yml     | 8 ++++++++
 6 files changed, 48 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d05ae2f6..aedd06f2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,6 +1,14 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
 name: CodeQL
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/echidna-verify.yml b/.github/workflows/echidna-verify.yml
index 11dfc3ff..5c299c19 100644
--- a/.github/workflows/echidna-verify.yml
+++ b/.github/workflows/echidna-verify.yml
@@ -1,6 +1,14 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
 name: ECHIDNA Proof Verification
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 76bd1a0e..4bb50e9a 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -18,6 +18,14 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
index 0244dbef..9490f4c1 100644
--- a/.github/workflows/scorecard-enforcer.yml
+++ b/.github/workflows/scorecard-enforcer.yml
@@ -10,6 +10,14 @@ on:
     - cron: '0 6 * * 1'
   workflow_dispatch:
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index bafb2659..1eb7aa72 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,6 +1,14 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
 name: OpenSSF Scorecard
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 843e901b..4486c7f3 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -7,6 +7,14 @@ on:
   push:
     branches: [main]
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read