Skip to content

ci(concurrency): scope noema/strix/opencode workflows by PR number #1787

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 11 commits into from
Closed

ci(concurrency): scope noema/strix/opencode workflows by PR number #1787

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
861e8d4
feat(hourly): onboard appguardrail (minute 41) and macos_utility_pack…
seonghobae Aug 25, 2026
59e34da
fix: align hourly review model and OIDC documentation
seonghobae Aug 25, 2026
19f323d
fix(strix): stop openai-direct fallbacks from inheriting the primary …
seonghobae Aug 25, 2026
9e87df4
experiment: standardize PR workflow concurrency keys
seonghobae Sep 3, 2026
3abc455
experiment: align additional workflow concurrency groups
seonghobae Sep 3, 2026
13faffe
experiment: normalize additional security workflow concurrency groups
seonghobae Sep 3, 2026
7ce613d
ci: standardize PR concurrency groups
seonghobae Sep 3, 2026
a73706f
experiment: enforce workflow-level concurrency defaults
seonghobae Sep 3, 2026
6847202
ci: keep PR-specific concurrency keyed by pull_request id across trig…
seonghobae Sep 3, 2026
9f7a6dd
ci(concurrency): scope noema/strix/opencode review runs by workflow-r…
seonghobae Sep 3, 2026
8da772e
ci(concurrency): align noema/strix/opencode to pr-number scope fallba…
seonghobae Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/agent-mention-router-quality-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ on:
- "requirements-opencode-review-ci-hashes.txt"

concurrency:
group: agent-mention-router-quality-${{ github.event.pull_request.number || github.ref }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

permissions:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/agent-mention-router.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@ on:
permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
cancel-in-progress: true

jobs:
route-local-agent-mention:
if: >-
Expand Down
39 changes: 39 additions & 0 deletions .github/workflows/appguardrail-hourly-review-repair.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
name: appguardrail Hourly Review Repair

on:
schedule:
# Minute 41 is the roster slot already reserved for Appguardrail across
# the hourly callers (see afipc/nonnest2/originweave cron comments). It
# avoids pg-llm-batch (1), aFIPC (2), kaefa (3), LineageWeave (4),
# codec-carver (5), life-os (6), Wardnet (7), mightyETL (8),
# psychometrics-commons (9), OriginWeave (10), naruon (11),
# DiagramWeave (12), pg-erd-cloud (13), mhtml-etl-gateway (14),
# html4tree (15), nonnest2 (16), orchestrator (17), noema (19),
# Clearfolio (23), Keyverse (29), Scopeweave (31), DiskSage (37),
# newsdom-api (43), macOS utility packs (44), Inkspan (47),
# fast-mlsirm (49), BandScope (53), and semantic-data-portal (59).
- cron: "41 * * * *"

concurrency:
group: appguardrail-hourly-review-repair
# A later heartbeat must not cancel an in-flight scan RCA.
cancel-in-progress: false

permissions:
contents: read

jobs:
dispatch-review-repair:
permissions:
contents: read
id-token: write
uses: ./.github/workflows/pr-review-fix-scheduler.yml
with:
target_repository: ContextualWisdomLab/appguardrail
base_branch: develop
max_prs: "50"
max_dispatches: "1"
retry_hours: "2"
secrets:
PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}
OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}
5 changes: 1 addition & 4 deletions .github/workflows/close-empty-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,7 @@ on:
types: [opened, synchronize, reopened, ready_for_review, closed]

concurrency:
group: >-
close-empty-pr-${{
github.event_name == 'pull_request_target' && github.event.pull_request.base.repo.full_name || github.repository }}-${{
github.event_name == 'pull_request_target' && github.event.pull_request.number || github.run_id }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

permissions:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/cloudflare-dns.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,8 @@ on:
# push-triggered runs are always dry-run (safe by default);
# only an explicit repository_dispatch with mode=apply is allowed to write.
concurrency:
group: cloudflare-dns-${{ github.ref }}
cancel-in-progress: false
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true
Comment on lines +37 to +38

@devin-ai-integration devin-ai-integration Bot Sep 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Cloudflare apply can be cancelled mid-reconcile by a later run

For push and repository_dispatch there is no PR number, so every such run shares the constant group, and cancel-in-progress was flipped from false to true. A push dry-run or a second apply now cancels an in-flight mode=apply reconcile, which can leave DNS records partially written.

Suggested change
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: false
Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.


permissions:
contents: read
Expand Down
5 changes: 1 addition & 4 deletions .github/workflows/codeql-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,7 @@ on:
branches: [main, master, develop]

concurrency:
group: >-
codeql-pr-${{
github.event_name == 'pull_request' && github.event.pull_request.base.repo.full_name || github.repository }}-${{
github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

permissions:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/deploy-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,10 @@ on:
permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.event.workflow_call.head_repository.full_name || github.run_id }}

@devin-ai-integration devin-ai-integration Bot Sep 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: deploy-pages concurrency references a non-existent context property

github.event.workflow_call.head_repository.full_name is not a real context property, so it always resolves empty and the group falls through to github.run_id. Harmless because run_id makes each call unique, but the middle term never contributes.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

cancel-in-progress: true

jobs:
deploy_pages:
name: Deploy ${{ inputs.project_name }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/exact-artifact-sbom-attestation-quality.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ on:
- "CHANGELOG.md"

concurrency:
group: exact-artifact-sbom-attestation-quality-${{ github.event.pull_request.number || github.ref }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

permissions:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/exact-artifact-sbom-attestation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,10 @@ permissions:
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

concurrency:
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
cancel-in-progress: true

jobs:
verify-evidence-artifact:
name: Verify inert sealed evidence
Expand Down
16 changes: 15 additions & 1 deletion .github/workflows/hourly-nvidia-nim-review-repair.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ on:
- .github/workflows/originweave-hourly-review-repair.yml
- .github/workflows/quarantine-sandbox-hourly-review-repair.yml
- .github/workflows/afipc-hourly-review-repair.yml
- .github/workflows/appguardrail-hourly-review-repair.yml
- .github/workflows/macos_utility_packs-hourly-review-repair.yml
- scripts/ci/pr_review_conflict_scope.py
- scripts/ci/pr_review_autofix_context.py
- tests/test_bandscope_hourly_review_caller.py
Expand All @@ -31,6 +33,8 @@ on:
- tests/test_originweave_hourly_review_caller.py
- tests/test_quarantine_sandbox_hourly_review_caller.py
- tests/test_afipc_hourly_review_caller.py
- tests/test_appguardrail_hourly_review_caller.py
- tests/test_macos_utility_packs_hourly_review_caller.py
- tests/test_hourly_autofix_context_quality_gate.py
- tests/test_pr_review_conflict_scope.py
- tests/test_pr_review_conflict_scope_control_files.py
Expand All @@ -57,6 +61,8 @@ on:
- docs/doctoring/originweave-hourly-review-caller.md
- docs/doctoring/quarantine-sandbox-hourly-review-caller.md
- docs/doctoring/afipc-hourly-review-caller.md
- docs/doctoring/appguardrail-hourly-review-caller.md
- docs/doctoring/macos-utility-packs-hourly-review-caller.md
push:
paths:
- .github/workflows/pr-review-fix-scheduler.yml
Expand All @@ -74,6 +80,8 @@ on:
- .github/workflows/originweave-hourly-review-repair.yml
- .github/workflows/quarantine-sandbox-hourly-review-repair.yml
- .github/workflows/afipc-hourly-review-repair.yml
- .github/workflows/appguardrail-hourly-review-repair.yml
- .github/workflows/macos_utility_packs-hourly-review-repair.yml
- scripts/ci/pr_review_conflict_scope.py
- scripts/ci/pr_review_autofix_context.py
- tests/test_bandscope_hourly_review_caller.py
Expand All @@ -87,6 +95,8 @@ on:
- tests/test_originweave_hourly_review_caller.py
- tests/test_quarantine_sandbox_hourly_review_caller.py
- tests/test_afipc_hourly_review_caller.py
- tests/test_appguardrail_hourly_review_caller.py
- tests/test_macos_utility_packs_hourly_review_caller.py
- tests/test_hourly_autofix_context_quality_gate.py
- tests/test_pr_review_conflict_scope.py
- tests/test_pr_review_conflict_scope_control_files.py
Expand All @@ -113,12 +123,14 @@ on:
- docs/doctoring/originweave-hourly-review-caller.md
- docs/doctoring/quarantine-sandbox-hourly-review-caller.md
- docs/doctoring/afipc-hourly-review-caller.md
- docs/doctoring/appguardrail-hourly-review-caller.md
- docs/doctoring/macos-utility-packs-hourly-review-caller.md

permissions:
contents: read

concurrency:
group: hourly-nvidia-nim-review-repair-${{ github.event.pull_request.number || github.ref }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

jobs:
Expand Down Expand Up @@ -171,6 +183,8 @@ jobs:
tests/test_originweave_hourly_review_caller.py \
tests/test_quarantine_sandbox_hourly_review_caller.py \
tests/test_afipc_hourly_review_caller.py \
tests/test_appguardrail_hourly_review_caller.py \
tests/test_macos_utility_packs_hourly_review_caller.py \
tests/test_pr_review_conflict_scope_control_files.py \
tests/test_hourly_autofix_context_quality_gate.py \
tests/test_pr_review_conflict_scope_git_executable.py \
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/javascript-coverage-quality-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ permissions:
contents: read

concurrency:
group: javascript-coverage-quality-${{ github.event.pull_request.number || github.ref }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

jobs:
Expand Down
39 changes: 39 additions & 0 deletions .github/workflows/macos_utility_packs-hourly-review-repair.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
name: macOS utility packs Hourly Review Repair

on:
schedule:
# Minute 44 is a fresh roster allocation for the macOS utility packs
# bootstrap. It avoids pg-llm-batch (1), aFIPC (2), kaefa (3),
# LineageWeave (4), codec-carver (5), life-os (6), Wardnet (7),
# mightyETL (8), psychometrics-commons (9), OriginWeave (10),
# naruon (11), DiagramWeave (12), pg-erd-cloud (13),
# mhtml-etl-gateway (14), html4tree (15), nonnest2 (16),
# orchestrator (17), noema (19), Clearfolio (23), Keyverse (29),
# Scopeweave (31), DiskSage (37), Appguardrail (41), newsdom-api (43),
# Inkspan (47), fast-mlsirm (49), BandScope (53), and
# semantic-data-portal (59).
- cron: "44 * * * *"

concurrency:
group: macos_utility_packs-hourly-review-repair
# A later heartbeat must not cancel an in-flight bootstrap RCA.
cancel-in-progress: false

permissions:
contents: read

jobs:
dispatch-review-repair:
permissions:
contents: read
id-token: write
uses: ./.github/workflows/pr-review-fix-scheduler.yml
with:
target_repository: ContextualWisdomLab/macos_utility_packs
base_branch: develop
max_prs: "50"
max_dispatches: "1"
retry_hours: "2"
secrets:
PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}
OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}
10 changes: 1 addition & 9 deletions .github/workflows/noema-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,15 +18,7 @@ on:
types: [noema-review]

concurrency:
group: >-
noema-review-${{
github.event_name == 'pull_request_target' && github.event.pull_request.base.repo.full_name ||
github.event_name == 'repository_dispatch' && github.event.client_payload.target_repository ||
github.repository }}-${{ github.event_name }}-${{
github.event_name == 'pull_request_target' && format('pr-{0}', github.event.pull_request.number) ||
github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number && format('pr-{0}', github.event.workflow_run.pull_requests[0].number) ||
github.event_name == 'repository_dispatch' && github.event.client_payload.pr_number ||
github.run_id }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.event.client_payload.pr_number || github.event.workflow_run.pull_requests[0].number }}

@devin-ai-integration devin-ai-integration Bot Sep 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Noema review may cancel across event types for the same PR

The old group included github.event_name; the new one merges pull_request_target, workflow_run, and repository_dispatch for a PR into one group. A retry dispatch or workflow_run completion can cancel an in-progress required pull_request_target review. Additionally, workflow_run events with an empty pull_requests array leave every number term empty and collapse to the constant <workflow>-<repo>- group.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

cancel-in-progress: true

permissions:
Expand Down
11 changes: 5 additions & 6 deletions .github/workflows/opencode-review-dispatch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,7 @@ on:

concurrency:
# PR-number scope keeps stale dispatches replaced for the current head.
group: >-
opencode-review-repository-dispatch-${{
github.event.client_payload.target_repository || github.repository }}-${{
github.event.client_payload.pr_number && format('pr-{0}', github.event.client_payload.pr_number) ||
github.run_id }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.client_payload.pr_number || github.event.pull_request.number || github.event.workflow_run.pull_requests[0].number }}

@devin-ai-integration devin-ai-integration Bot Sep 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Review dispatches for different repos with the same PR number cancel each other

For repository_dispatch, github.repository is always the central .github repo, and the group no longer includes client_payload.target_repository. Two target repos reviewing the same PR number now share one group, so cancel-in-progress kills the earlier review.

Suggested change
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.client_payload.pr_number || github.event.pull_request.number || github.event.workflow_run.pull_requests[0].number }}
group: ${{ github.workflow }}-${{ github.event.client_payload.target_repository || github.repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

cancel-in-progress: true

permissions:
Expand Down Expand Up @@ -4471,12 +4467,15 @@ jobs:
# or used for product/model improvement, so private repositories
# include neither NIM nor anonymous free candidates and start at the
# existing keyed fallback list: OpenCode Zen GPT-5.6 Terra, DeepSeek
# V3, the direct GPT-5.4 slot, and pinned PAID
# V3, the direct OpenAI gpt-5.4 slot, and pinned PAID
# OpenRouter coder models (free-tier candidates hit the shared
# free-models-per-day cap and hung for the full candidate timeout,
# so the OpenRouter slots use cheap paid models billed against the
# org's OpenRouter credits), then the full-size GPT-4.1 long-context
# endpoint and provider-specific GPT/o3 fallbacks.
# The direct-OpenAI slot runs gpt-5.4. Candidate order is bound to
# the provider/model contract and review capability; it does not
# infer a ranking from unverified or time-varying price claims.
OPENCODE_MODEL_CANDIDATES: "${{ needs.validate-pr-metadata.outputs.is_private == 'false' && 'nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5 nvidia-nim/nvidia/llama-3.1-nemotron-ultra-253b-v1 nvidia-nim/nvidia/nemotron-3-super-120b-a12b nvidia-nim/nvidia/nemotron-3-ultra-550b-a55b nvidia-nim/meta/llama-3.3-70b-instruct nvidia-nim/deepseek-ai/deepseek-v4-pro nvidia-nim/mistralai/codestral-22b-instruct-v0.1 opencode-free/nemotron-3-ultra-free opencode-free/deepseek-v4-flash-free opencode-free/north-mini-code-free opencode-free/laguna-s-2.1-free opencode-free/ling-3.0-flash-free opencode-free/big-pickle opencode-free/mimo-v2.5-free opencode-free/hy3-free opencode-free/minimax-m3-free opencode-free/glm-5-free opencode-free/kimi-k2.5-free opencode-free/qwen3.6-plus-free ' || '' }}opencode/gpt-5.6-terra github-models/deepseek/deepseek-v3-0324 openai/gpt-5.4 openrouter/deepseek/deepseek-v3.2 openrouter/qwen/qwen3-coder github-models/openai/gpt-4.1 github-models/openai/gpt-5 github-models/openai/gpt-5-chat github-models/openai/o3 github-models/deepseek/deepseek-r1-0528 github-models/deepseek/deepseek-r1"
# One attempt per model, then fall through to the next model. Retrying
# the SAME model 5x let a rate-limited/hung leader consume the whole
Expand Down
5 changes: 1 addition & 4 deletions .github/workflows/opencode-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,7 @@ on:
types: [opened, synchronize, reopened, ready_for_review, closed]

concurrency:
group: >-
opencode-review-bootstrap-${{
github.event.pull_request.base.repo.full_name || github.repository }}-${{
github.event.pull_request.number || github.run_id }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

permissions:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/opencode-rust-coverage-toolchain-quality-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ permissions:
contents: read

concurrency:
group: opencode-rust-coverage-toolchain-quality-${{ github.event.pull_request.number || github.ref }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

jobs:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/organization-commercial-readiness-loop-quality-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ permissions:
contents: read

concurrency:
group: organization-commercial-readiness-loop-quality-${{ github.event.pull_request.number || github.ref }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

jobs:
Expand Down
5 changes: 1 addition & 4 deletions .github/workflows/osv-scanner-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,7 @@ on:
branches: [main, master, develop]

concurrency:
group: >-
osv-scanner-pr-${{
github.event_name == 'pull_request' && github.event.pull_request.base.repo.full_name || github.repository }}-${{
github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

permissions:
Expand Down
17 changes: 2 additions & 15 deletions .github/workflows/pr-review-merge-scheduler.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,21 +87,8 @@ on:
types: [merge-scheduler]

concurrency:
group: >-
central-pr-review-merge-scheduler-${{ github.repository }}-${{
github.event_name == 'pull_request_target' && format('pr-{0}', github.event.pull_request.number) ||
github.event_name == 'pull_request_review' && format('pr-{0}', github.event.pull_request.number) ||
github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number && format('pr-{0}', github.event.workflow_run.pull_requests[0].number) ||
github.event_name == 'workflow_run' && !github.event.workflow_run.pull_requests[0].number && format('workflow-run-no-pr-{0}', github.repository) ||
github.event_name == 'workflow_call' && inputs.pr_number != '' && format('pr-{0}', inputs.pr_number) ||
github.event_name == 'workflow_call' && inputs.base_branch != '' && format('call-{0}', inputs.base_branch) ||
github.event_name == 'schedule' && format('schedule-{0}', github.event.schedule) ||
github.event_name == 'repository_dispatch' && github.event.client_payload.org_sweep == true && format('org-sweep-{0}', github.repository) ||
github.event_name == 'repository_dispatch' && github.event.client_payload.target_repository != '' && github.event.client_payload.pr_number != '' && format('target-{0}-pr-{1}', github.event.client_payload.target_repository, github.event.client_payload.pr_number) ||
github.event_name == 'repository_dispatch' && github.event.client_payload.pr_number != '' && format('pr-{0}', github.event.client_payload.pr_number) ||
github.event_name == 'repository_dispatch' && format('repo-dispatch-{0}', github.repository) ||
github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review' || github.event_name == 'repository_dispatch' || (github.event_name == 'workflow_run' && !github.event.workflow_run.pull_requests[0].number) }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.event.workflow_run.pull_requests[0].number || inputs.pr_number || github.event.client_payload.pr_number || github.run_id }}
cancel-in-progress: true
Comment on lines +90 to +91

@devin-ai-integration devin-ai-integration Bot Sep 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Merge scheduler cancel-in-progress made unconditional

cancel-in-progress is now always true, where the old key excluded schedule and org-sweep runs. The retained github.run_id fallback gives those events unique groups, so behavior is preserved. Confirm that repository_dispatch runs with a pr_number for different target repos do not collide, since github.repository is the constant .github and the old key included target_repository.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.


# Scorecard Token-Permissions (alert #9): declare a least-privilege default at
# the workflow level. The scan-pr-queue job that actually needs write access
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/python-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ on:
types: [python-security-scan]

concurrency:
group: python-security-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{ github.event.pull_request.number || github.ref }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}

@devin-ai-integration devin-ai-integration Bot Sep 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Push and scheduled security scans across branches cancel one another

The group dropped its github.ref fallback, so every non-PR event (push to main, master, or develop, the weekly schedule, and repository_dispatch) resolves to the constant <workflow>-<repo>-. With cancel-in-progress they share one group and cancel each other. Identical regression in secret-scan and sast-semgrep.

Suggested change
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

cancel-in-progress: true

permissions:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/repair-pr827-coderabbit-comments.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ permissions:
contents: read

concurrency:
group: repair-pr827-coderabbit-comments
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

jobs:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/sast-semgrep.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ on:
types: [sast-semgrep-scan]

concurrency:
group: sast-semgrep-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{ github.event.pull_request.number || github.ref }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

permissions:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/sbom-generation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ on:
types: [published]

concurrency:
group: sbom-generation-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{ github.event.pull_request.number || github.event.release.tag_name || github.ref }}
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}

@devin-ai-integration devin-ai-integration Bot Sep 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Concurrent releases cancel each other's SBOM upload

Release events carry no PR number, so the group collapses to the constant <workflow>-<repo>- after the release.tag_name fallback was removed. Two releases published close together share it, and cancel-in-progress aborts the earlier SBOM and release-asset upload.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

cancel-in-progress: true

permissions:
Expand Down
Loading
Loading