fix: isolate required workflow concurrency by PR head

.github/workflows/close-empty-pr.yml

@@ -13,7 +13,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review, closed]
 
 concurrency:
-  group: close-empty-pr-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{ github.event.pull_request.number }}
+  group: >-
+    close-empty-pr-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{
+    github.event.pull_request.number }}-${{ github.event.pull_request.head.sha || github.run_id }}
   cancel-in-progress: true
 
 permissions:

.github/workflows/opencode-review.yml

@@ -36,7 +36,8 @@ concurrency:
   group: >-
     opencode-review-${{
     github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }}-${{
-    github.event_name == 'pull_request_target' && format('pr-{0}', github.event.pull_request.number) ||
+    github.event_name == 'pull_request_target' && format('pr-{0}-{1}', github.event.pull_request.number, github.event.pull_request.head.sha) ||
+    github.event.inputs.pr_number && github.event.inputs.pr_head_sha && format('pr-{0}-{1}', github.event.inputs.pr_number, github.event.inputs.pr_head_sha) ||
     github.event.inputs.pr_number && format('pr-{0}', github.event.inputs.pr_number) ||
     github.event.inputs.pr_number || github.run_id }}
   cancel-in-progress: true
@@ -1538,7 +1539,7 @@ jobs:
           npx -y "$CODEGRAPH_PACKAGE" status
 
       - name: Prepare bounded OpenCode review evidence
-        timeout-minutes: 40
+        timeout-minutes: 12
         env:
           GH_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN || steps.review_read_app_token.outputs.token || github.token }}
           GH_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }}

.github/workflows/pr-review-merge-scheduler.yml

@@ -118,7 +118,7 @@ on:
 concurrency:
   group: >-
     central-pr-review-merge-scheduler-${{ github.repository }}-${{
-    github.event_name == 'pull_request_target' && format('pr-{0}', github.event.pull_request.number) ||
+    github.event_name == 'pull_request_target' && format('pr-{0}-{1}', github.event.pull_request.number, github.event.pull_request.head.sha) ||
     github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number && format('pr-{0}', github.event.workflow_run.pull_requests[0].number) ||
     github.event_name == 'workflow_call' && inputs.pr_number != '' && format('pr-{0}', inputs.pr_number) ||
     github.event_name == 'workflow_call' && inputs.base_branch != '' && format('call-{0}', inputs.base_branch) ||

.github/workflows/security-scan.yml

@@ -33,7 +33,9 @@ on:
     branches: [main, master, develop]
 
 concurrency:
-  group: security-scan-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{ github.event.pull_request.number }}
+  group: >-
+    security-scan-${{ github.event.pull_request.base.repo.full_name || github.repository }}-${{
+    github.event.pull_request.number }}-${{ github.event.pull_request.head.sha || github.run_id }}
   cancel-in-progress: true
 
 # Scorecard Token-Permissions (alert #42): workflow-level token stays

scripts/ci/pr_review_merge_scheduler.py

@@ -109,7 +109,7 @@
 """ + PULL_REQUEST_FIELDS_FRAGMENT
 
 OPEN_PRS_PAGE_SIZE = 25
-# Must exceed the opencode-review job timeout (360 min) plus typical runner-queue
+# Must exceed the opencode-review job timeout (120 min) plus typical runner-queue
 # wait. QUEUED counts as running and the age clock starts at check creation, so a
 # 45-minute threshold marked every queued/long review "stale" and re-dispatched
 # it; each re-dispatch went to the back of the runner queue and itself went

tests/test_opencode_agent_contract.py

@@ -353,8 +353,9 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
     assert "opencode_review_model_pool" in workflow
     assert "run_opencode_review_model_pool.sh" in workflow
     assert "rekick_model_pool_on_exhaustion" in workflow
-    assert "format('pr-{0}', github.event.pull_request.number)" in workflow
-    assert "format('pr-{0}-{1}', github.event.pull_request.number, github.event.pull_request.head.sha)" not in workflow
+    assert "format('pr-{0}-{1}', github.event.pull_request.number, github.event.pull_request.head.sha)" in workflow
+    assert "format('pr-{0}-{1}', github.event.inputs.pr_number, github.event.inputs.pr_head_sha)" in workflow
+    assert "github.event.inputs.pr_number && format('pr-{0}', github.event.inputs.pr_number)" in workflow
     assert "OPENCODE_MODEL_CANDIDATES" in workflow
     model_pool_runner = Path("scripts/ci/run_opencode_review_model_pool.sh").read_text(encoding="utf-8")
     assert "assert_reasoning_effort_for_candidate" in model_pool_runner
@@ -403,6 +404,7 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
     assert '"## Check outcome"' not in workflow
     assert "publish REQUEST_CHANGES when coverage-evidence blocker states" in workflow
     assert re.search(r"opencode-review-target:[\s\S]*?timeout-minutes: 75", workflow)
+    assert re.search(r"Prepare bounded OpenCode review evidence[\s\S]{0,120}timeout-minutes: 12", workflow)
     assert 'timeout-minutes: 35' in workflow
     assert re.search(r"Run OpenCode PR Review model pool[\s\S]{0,240}timeout-minutes: 25", workflow)
     assert re.search(r"Run OpenCode PR Review model pool[\s\S]{0,280}continue-on-error: true", workflow)

tests/test_required_workflow_queue_contract.py

@@ -39,8 +39,11 @@ def test_required_pull_request_workflows_cancel_superseded_runs() -> None:
         assert "github.repository" in concurrency_contract
         assert "github.event.pull_request.number" in workflow
         assert "cancel-in-progress: true" in workflow
-        assert "github.event.pull_request.head.sha" not in concurrency_contract
-        assert "format('pr-{0}-{1}'" not in concurrency_contract
+        if filename in {"close-empty-pr.yml", "opencode-review.yml", "security-scan.yml"}:
+            assert "github.event.pull_request.head.sha" in concurrency_contract
+        else:
+            assert "github.event.pull_request.head.sha" not in concurrency_contract
+            assert "format('pr-{0}-{1}'" not in concurrency_contract
 
 
 def test_strix_keeps_current_head_security_evidence_logs() -> None: