ci: Avoid release-plz closing PRs unnecessarily (#2472)

If two instances of the `release-plz` workflow ran at the same time (due
to multiple rust PRs being merged together), the newer one may try to
update the release branch with stale ref info, and resort to re-creating
the release PR instead.

This change avoids that situation by ensuring no two instances of the
workflow run concurrently for the same branch.

- Stale info error:
https://github.com/CQCL/hugr/actions/runs/16497826514/job/46647892322#step:5:305
- PR closed for no reason: #2443

Author: aborgna-q

.github/workflows/release-plz.yml

@@ -6,12 +6,46 @@ on:
     branches:
       - main
 
+
 env:
   LLVM_VERSION: "14.0"
 
 jobs:
+  release-plz-pr:
+    name: Create release-plz PR
+    runs-on: ubuntu-latest
+
+    # Ensure only one release-plz tries to create a PR at a time.
+    #
+    # If two instances update the PR simultaneously, one will see an outdated git ref
+    # and end up recreating the PR unnecessarily.
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-pr
+      cancel-in-progress: true
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.HUGRBOT_PAT }}
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Create release PR
+        uses: MarcoIeni/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.HUGRBOT_PAT }}
+        with:
+          command: release-pr
+
+  # This job triggers the release to crates.io if the current crate version is higher than the
+  # ones in the registry.
+  #
+  # Release-plz will only run on commits originating from a PR whose source branch started with
+  # `release-plz-` (see `release-always=false` in the config).
   release-plz:
-    name: Release-plz
+    name: Release the crates
     runs-on: ubuntu-latest
     environment: crate-release
     permissions:
@@ -43,3 +77,5 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.HUGRBOT_PAT }}
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+        with:
+          command: release