From a4298059c69aefdafd3b1482ba65f9eb06137c79 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Fri, 30 Oct 2026 16:08:28 -0400
Subject: [PATCH] ci: Cancel superseded pull request runs

A burst of pushes or Renovate rebases queues a full CI run per push, and
nothing cancels the runs a newer push has replaced, so the org queue backs
up and stalls default-branch builds and releases. On 24 October milo-os
reached about 700 queued runs this way.

Add a top-level concurrency group to every workflow triggered by push or
pull_request, except publish-only and reusable workflows. A newer push
cancels the older run on the same pull request or non-default branch.
Runs on the default branch and on tags are never cancelled mid-flight,
though a newer pending run replaces an older pending one.

Related to datum-cloud/infra#7686
---
 .github/workflows/build-and-test.yaml | 4 ++++
 .github/workflows/lint.yml            | 4 ++++
 .github/workflows/test.yml            | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml
index 7eb9acc..87ee130 100644
--- a/.github/workflows/build-and-test.yaml
+++ b/.github/workflows/build-and-test.yaml
@@ -10,6 +10,10 @@ on:
     types:
       - published
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (startsWith(github.ref, 'refs/heads/') && github.ref != format('refs/heads/{0}', github.event.repository.default_branch)) }}
+
 jobs:
   publish-container-image:
     permissions:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 56747a3..b485209 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,6 +4,10 @@ on:
   push:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (startsWith(github.ref, 'refs/heads/') && github.ref != format('refs/heads/{0}', github.event.repository.default_branch)) }}
+
 jobs:
   lint:
     name: Run on Ubuntu
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9bb6941..1cf4338 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,10 @@ on:
   push:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (startsWith(github.ref, 'refs/heads/') && github.ref != format('refs/heads/{0}', github.event.repository.default_branch)) }}
+
 jobs:
   test:
     name: Run on Ubuntu