chore(OmniRoute): add concurrency blocks to 6 remaining workflows

[KooshaPari]

User description

Summary

• Add cancel-in-progress concurrency groups to 6 workflows missing them:
  • build-fork.yml
  • claude.yml
  • docker-publish.yml
  • electron-release.yml
  • lock-released-branch.yml
  • npm-publish.yml

Test plan

• Verify each workflow has concurrency: block at top level
• Confirm cancel-in-progress on rapid push

🤖 Generated with Claude Code

---

Note

Low Risk
Workflow-only YAML; behavior change is cancelling superseded CI runs, not application or release logic.

Overview
Adds GitHub Actions concurrency to six workflows that did not have it yet, matching the existing ci.yml pattern: one group per workflow plus ref, with cancel-in-progress: true.

Affected workflows: fork GHCR build, Claude Code, Docker Hub publish, Electron release, lock released branch, and npm publish. Rapid re-triggers on the same ref will cancel older runs instead of stacking parallel jobs (fewer duplicate builds/publishes and less runner queue pressure).

No job steps, triggers, or secrets change—only top-level workflow YAML.

^{Reviewed by Cursor Bugbot for commit d20ed5e. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Prevent overlapping workflow runs from piling up on the same branch or tag

What Changed

• Six GitHub Actions workflows now cancel older runs when a newer run starts on the same ref
• This applies to builds, publishing, release, and Claude comment workflows
• Re-triggering one of these workflows no longer leaves duplicate runs waiting or executing at the same time

Impact

✅ Fewer duplicate CI runs
✅ Less runner queue pressure
✅ Faster feedback on the latest push

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Review limit reached

@KooshaPari, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 44 minutes and 31 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1f4091aa-32f1-4709-a6ac-c6f1cc59b585

📥 Commits

Reviewing files that changed from the base of the PR and between 4d0ab89 and d20ed5e.

📒 Files selected for processing (6)

• .github/workflows/build-fork.yml
• .github/workflows/claude.yml
• .github/workflows/docker-publish.yml
• .github/workflows/electron-release.yml
• .github/workflows/lock-released-branch.yml
• .github/workflows/npm-publish.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch omniroute/concurrency-hardening

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch omniroute/concurrency-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
5 Security Hotspots
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

Bugbot Autofix prepared fixes for all 3 issues found in the latest run.

• ✅ Fixed: Concurrency group cancels all Claude runs across PRs
  • Changed concurrency group to use issue/PR number instead of github.ref, ensuring each issue/PR has its own concurrency group and preventing cross-PR cancellation.
• ✅ Fixed: Security workflow can be cancelled mid-execution by dispatch
  • Changed cancel-in-progress from true to false to ensure lock operations complete before concurrent dispatches can interfere.
• ✅ Fixed: Reusable workflow concurrency causes deadlock when called via workflow_call
  • Removed top-level concurrency block from npm-publish.yml to prevent deadlock when called as a reusable workflow by electron-release.yml.

Or push these changes by commenting:

@cursor push 2bd4c89791

Preview (2bd4c89791)

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -1,6 +1,6 @@
 name: Claude Code
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.issue.number || github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 on:

diff --git a/.github/workflows/lock-released-branch.yml b/.github/workflows/lock-released-branch.yml
--- a/.github/workflows/lock-released-branch.yml
+++ b/.github/workflows/lock-released-branch.yml
@@ -2,7 +2,7 @@
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 # Two responsibilities (defense in depth — Hard Rule #18 enforcement):
 #

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -1,7 +1,4 @@
 name: Publish to npm
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
 
 on:
   # 'released' (not 'published') so editing/re-publishing old releases does NOT

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit d20ed5e. Configure here.}

[cursor]

Concurrency group cancels all Claude runs across PRs

High Severity

For issue_comment and pull_request_review_comment events, github.ref is always the default branch (e.g., refs/heads/main), not the PR branch. This means every Claude Code invocation shares the same concurrency group (Claude Code-refs/heads/main). With cancel-in-progress: true, any new comment on any issue or PR — even one that doesn't mention @claude — triggers the workflow, joins the shared group, and cancels the in-progress run before the job-level if condition filtering for @claude is evaluated. This effectively makes Claude unable to complete any task if comments arrive on other issues/PRs.

 

^{Reviewed by Cursor Bugbot for commit d20ed5e. Configure here.}

[cursor]

Security workflow can be cancelled mid-execution by dispatch

Medium Severity

This security-critical workflow locks release branches to prevent post-release commits. With cancel-in-progress: true, two workflow_dispatch calls from the same ref (e.g., dispatched from main to lock different tags) would share the same concurrency group, causing the first lock operation to be cancelled before completing. A branch could remain unlocked, violating the "Hard Rule #18" this workflow is explicitly designed to enforce.

 

^{Reviewed by Cursor Bugbot for commit d20ed5e. Configure here.}

[cursor]

Reusable workflow concurrency causes deadlock when called via workflow_call

High Severity

npm-publish.yml is called as a reusable workflow via workflow_call from electron-release.yml. When called this way, github.workflow inherits the caller's name ("Build Electron Desktop App"), making both workflows resolve to the same concurrency group. GitHub Actions detects this as a deadlock — the caller is in-progress in the group while the called workflow tries to enter it — and the reusable workflow fails immediately. This breaks npm publishing when triggered through the electron release flow.

Additional Locations (1)

• .github/workflows/electron-release.yml#L1-L4

 

^{Reviewed by Cursor Bugbot for commit d20ed5e. Configure here.}

[kilo-code-bot]

Code Review Summary

Status: Issues Found | Recommendation: Address critical issues before merge

Overview

Severity	Count
CRITICAL	3

Issue Details (click to expand)

CRITICAL

File	Line	Issue
.github/workflows/claude.yml	4	Concurrency group ${{ github.workflow }}-${{ github.ref }} will cancel Claude runs across different PRs when they reference the same branch. Claude Code processes comments on multiple PRs and should not interfere.
.github/workflows/lock-released-branch.yml	5	Security-sensitive workflow applying branch protection. Cancellation mid-execution during release events could leave branches unlocked.
.github/workflows/npm-publish.yml	4	Reusable workflow - github.workflow resolves to caller's workflow name, causing cross-workflow cancellation and potential deadlocks.

Other Observations (not in diff)

build-fork.yml, docker-publish.yml, and electron-release.yml are appropriate for this pattern - preventing duplicate builds/publishes is correct.

Consider whether claude.yml should use a broader group ${{ github.workflow }} or a more specific group per issue/PR to avoid cross-interference.

Files Reviewed (6 files)

• .github/workflows/build-fork.yml
• .github/workflows/claude.yml
• .github/workflows/docker-publish.yml
• .github/workflows/electron-release.yml
• .github/workflows/lock-released-branch.yml
• .github/workflows/npm-publish.yml

---

_{Reviewed by laguna-m.1-20260312:free · 1,032,535 tokens}