From bb617f206ae5d5470c6a19c09026985057719064 Mon Sep 17 00:00:00 2001
From: Jurie Smit <smit.jurie@gmail.com>
Date: Wed, 12 Aug 2026 16:29:18 +0200
Subject: [PATCH] ci: add concurrency groups to cancel superseded PR runs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Superseded runs currently burn to completion instead of cancelling.
Measured in mystira-workspace over the same period: a workflow without
concurrency had 72 supersessions run to completion (856 wasted
wall-minutes, zero cancelled), while one with cancel-in-progress had 38
supersessions cancelled within ~1 min each (36 min total).

CI workflows cancel on pull_request only — ci.yml, lint.yml,
monorepo-ci.yml, security.yml, validate-templates.yml, and
validate-version.yml:

  concurrency:
    group: <workflow-id>-${{ github.event.pull_request.number || github.ref }}
    cancel-in-progress: ${{ github.event_name == 'pull_request' }}

Deploy, release, and destroy workflows get a group with NO
cancel-in-progress so runs serialise instead of being interrupted:
deploy-autopr-engine, deploy-website, destroy-infra, the five release-*
workflows, and copilot-setup-steps.

pr-comment-handler.yml keys on github.event.issue.number, since
issue_comment events carry no pull_request object, and does not cancel —
cancelling it would silently drop a queued command.

Indentation follows each file's existing style (four spaces in
monorepo-ci.yml, release-*.yml, and validate-version.yml; two
elsewhere).

No merge queue is configured on this repo, so gating cannot stall a
queue. actionlint reports the same five pre-existing findings before and
after this change.
---
 .github/workflows/ci.yml                          | 4 ++++
 .github/workflows/copilot-setup-steps.yml         | 3 +++
 .github/workflows/deploy-autopr-engine.yml        | 3 +++
 .github/workflows/deploy-website.yml              | 3 +++
 .github/workflows/destroy-infra.yml               | 3 +++
 .github/workflows/lint.yml                        | 4 ++++
 .github/workflows/monorepo-ci.yml                 | 4 ++++
 .github/workflows/pr-comment-handler.yml          | 3 +++
 .github/workflows/release-desktop.yml             | 3 +++
 .github/workflows/release-orchestration-utils.yml | 3 +++
 .github/workflows/release-vscode-extension.yml    | 3 +++
 .github/workflows/release-website.yml             | 3 +++
 .github/workflows/release.yml                     | 3 +++
 .github/workflows/security.yml                    | 4 ++++
 .github/workflows/validate-templates.yml          | 4 ++++
 .github/workflows/validate-version.yml            | 4 ++++
 16 files changed, 54 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 06f6e07..374edf8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,10 @@ on:
       - "engine/**"
       - ".github/workflows/ci.yml"
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index f476bcf..241cb3b 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -7,6 +7,9 @@ name: Copilot Setup Steps
 
 on: workflow_dispatch
 
+concurrency:
+  group: copilot-setup-steps-${{ github.ref }}
+
 env:
   PYTHON_VERSION: "3.13"
 
diff --git a/.github/workflows/deploy-autopr-engine.yml b/.github/workflows/deploy-autopr-engine.yml
index ffae465..7f96627 100644
--- a/.github/workflows/deploy-autopr-engine.yml
+++ b/.github/workflows/deploy-autopr-engine.yml
@@ -20,6 +20,9 @@ on:
       - "scripts/setup-azure-auth-for-pipeline.ps1"
   workflow_dispatch:
 
+concurrency:
+  group: deploy-autopr-engine-${{ github.event.pull_request.number || github.ref }}
+
 env:
   IMAGE_REPOSITORY: codeflow-engine
 
diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index c0339aa..d3ff584 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -13,6 +13,9 @@ on:
       - ".github/workflows/deploy-website.yml"
   workflow_dispatch:
 
+concurrency:
+  group: deploy-website-${{ github.event.pull_request.number || github.ref }}
+
 permissions:
   contents: read
   pull-requests: write
diff --git a/.github/workflows/destroy-infra.yml b/.github/workflows/destroy-infra.yml
index 1359658..1ef0c0d 100644
--- a/.github/workflows/destroy-infra.yml
+++ b/.github/workflows/destroy-infra.yml
@@ -3,6 +3,9 @@ name: Destroy Infrastructure
 on:
   workflow_dispatch:
 
+concurrency:
+  group: destroy-infra-${{ github.ref }}
+
 jobs:
   destroy-infra:
     name: Destroy Infrastructure
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 185357f..1f7ea3a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -12,6 +12,10 @@ on:
       - "engine/**"
       - ".github/workflows/lint.yml"
 
+concurrency:
+  group: lint-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   ruff:
     name: Ruff Linting
diff --git a/.github/workflows/monorepo-ci.yml b/.github/workflows/monorepo-ci.yml
index 0b162bb..80776ed 100644
--- a/.github/workflows/monorepo-ci.yml
+++ b/.github/workflows/monorepo-ci.yml
@@ -21,6 +21,10 @@ on:
             - "vscode-extension/**"
             - ".github/workflows/monorepo-ci.yml"
 
+concurrency:
+    group: monorepo-ci-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
     changes:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-comment-handler.yml b/.github/workflows/pr-comment-handler.yml
index faadc10..b8daf12 100644
--- a/.github/workflows/pr-comment-handler.yml
+++ b/.github/workflows/pr-comment-handler.yml
@@ -4,6 +4,9 @@ on:
   issue_comment:
     types: [created]
 
+concurrency:
+  group: pr-comment-handler-${{ github.event.issue.number }}
+
 permissions:
   contents: write
 
diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index cab28ea..36e4657 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -5,6 +5,9 @@ on:
         tags:
             - "desktop-v*"
 
+concurrency:
+    group: release-desktop-${{ github.ref }}
+
 jobs:
     release:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/release-orchestration-utils.yml b/.github/workflows/release-orchestration-utils.yml
index 1a1a5f8..5afe4f4 100644
--- a/.github/workflows/release-orchestration-utils.yml
+++ b/.github/workflows/release-orchestration-utils.yml
@@ -5,6 +5,9 @@ on:
         tags:
             - "orchestration-utils-v*"
 
+concurrency:
+    group: release-orchestration-utils-${{ github.ref }}
+
 jobs:
     release:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/release-vscode-extension.yml b/.github/workflows/release-vscode-extension.yml
index d3aecc3..f5140a0 100644
--- a/.github/workflows/release-vscode-extension.yml
+++ b/.github/workflows/release-vscode-extension.yml
@@ -5,6 +5,9 @@ on:
         tags:
             - "vscode-extension-v*"
 
+concurrency:
+    group: release-vscode-extension-${{ github.ref }}
+
 jobs:
     release:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/release-website.yml b/.github/workflows/release-website.yml
index 98dd4a2..7352714 100644
--- a/.github/workflows/release-website.yml
+++ b/.github/workflows/release-website.yml
@@ -5,6 +5,9 @@ on:
         tags:
             - "website-v*"
 
+concurrency:
+    group: release-website-${{ github.ref }}
+
 jobs:
     release:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b299611..d01724a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - "engine-v*"
 
+concurrency:
+  group: release-${{ github.ref }}
+
 jobs:
   release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 160819e..0e7c5fb 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -14,6 +14,10 @@ on:
   schedule:
     - cron: "0 0 * * 1" # Weekly on Monday
 
+concurrency:
+  group: security-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
   security-events: write
diff --git a/.github/workflows/validate-templates.yml b/.github/workflows/validate-templates.yml
index 02cd576..5c67cf5 100644
--- a/.github/workflows/validate-templates.yml
+++ b/.github/workflows/validate-templates.yml
@@ -21,6 +21,10 @@ on:
       - "engine/install.ps1"
       - ".github/workflows/*.yml"
 
+concurrency:
+  group: validate-templates-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   validate-yaml:
     name: Validate YAML Files
diff --git a/.github/workflows/validate-version.yml b/.github/workflows/validate-version.yml
index 83c1458..7aee7ec 100644
--- a/.github/workflows/validate-version.yml
+++ b/.github/workflows/validate-version.yml
@@ -20,6 +20,10 @@ on:
             - "vscode-extension/package.json"
             - "orchestration/packages/@codeflow/utils/package.json"
 
+concurrency:
+    group: validate-version-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
     validate-version:
         runs-on: ubuntu-latest