From b5599a3f43280e8e9187fae62aa1b27b1b69b555 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Fri, 30 Oct 2026 16:08:05 -0400
Subject: [PATCH] ci: Cancel superseded pull request runs

A burst of pushes or Renovate rebases queues a full CI run per push, and
nothing cancels the runs a newer push has replaced, so the org queue backs
up and stalls default-branch builds and releases. On 24 October milo-os
reached about 700 queued runs this way.

Add a top-level concurrency group to every workflow triggered by push or
pull_request, except publish-only and reusable workflows. A newer push
cancels the older run on the same pull request or non-default branch.
Runs on the default branch and on tags are never cancelled mid-flight,
though a newer pending run replaces an older pending one.

Related to datum-cloud/infra#7686
---
 .github/workflows/bundle.yml             | 4 ++++
 .github/workflows/ci.yml                 | 4 ++++
 .github/workflows/set-project-month.yaml | 4 ++++
 .github/workflows/update-nix-hash.yml    | 4 ++++
 4 files changed, 16 insertions(+)

diff --git a/.github/workflows/bundle.yml b/.github/workflows/bundle.yml
index 135fd11..75afc99 100644
--- a/.github/workflows/bundle.yml
+++ b/.github/workflows/bundle.yml
@@ -18,6 +18,10 @@ on:
       - ".github/workflows/bundle.yml"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (startsWith(github.ref, 'refs/heads/') && github.ref != format('refs/heads/{0}', github.event.repository.default_branch)) }}
+
 jobs:
   bundle:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5aae9f3..35b537c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (startsWith(github.ref, 'refs/heads/') && github.ref != format('refs/heads/{0}', github.event.repository.default_branch)) }}
+
 jobs:
   ci:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/set-project-month.yaml b/.github/workflows/set-project-month.yaml
index 7697edb..50af2f3 100644
--- a/.github/workflows/set-project-month.yaml
+++ b/.github/workflows/set-project-month.yaml
@@ -4,6 +4,10 @@ on:
   pull_request:
     types: [opened, ready_for_review, reopened]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (startsWith(github.ref, 'refs/heads/') && github.ref != format('refs/heads/{0}', github.event.repository.default_branch)) }}
+
 jobs:
   set-month:
     uses: datum-cloud/actions/.github/workflows/set-project-month.yaml@v1.24.0
diff --git a/.github/workflows/update-nix-hash.yml b/.github/workflows/update-nix-hash.yml
index 484be8b..31e6b42 100644
--- a/.github/workflows/update-nix-hash.yml
+++ b/.github/workflows/update-nix-hash.yml
@@ -5,6 +5,10 @@ on:
     paths:
       - Cargo.lock
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (startsWith(github.ref, 'refs/heads/') && github.ref != format('refs/heads/{0}', github.event.repository.default_branch)) }}
+
 jobs:
   update-nix-hash:
     runs-on: ubuntu-latest