ci(OMN-19639): cancel superseded pull request runs in 21 workflows

.github/workflows/auto-tag-on-merge.yml

@@ -4,6 +4,12 @@ on:
   pull_request:
     types: [closed]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 # OMN-18658: this job used to delegate to the shared
 # `auto-tag-reusable.yml@main`, which pushed the release tag with the job's
 # default workflow GITHUB_TOKEN. A GITHUB_TOKEN push delivers no push event, so

.github/workflows/call-occ-preflight.yml

@@ -22,6 +22,12 @@ on:
     branches: [main, dev, "hotfix/**"]
     types: [opened, synchronize, reopened, ready_for_review]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 permissions:
   contents: read
   pull-requests: read

.github/workflows/call-receipt-gate.yml

@@ -26,6 +26,12 @@ on:
   merge_group:
     branches: [main, dev]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 permissions:
   contents: read
   pull-requests: read

.github/workflows/call-reject-skip.yml

@@ -19,6 +19,12 @@ on:
   merge_group:
     branches: [main, dev]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 permissions:
   contents: read
   pull-requests: read

.github/workflows/canonical-inference-gate.yml

@@ -35,6 +35,12 @@ on:
     branches: [main, dev]
   merge_group:
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 permissions:
   contents: read
 

.github/workflows/check-db-ownership.yml

@@ -21,6 +21,12 @@ on:
     types: [opened, edited, synchronize, reopened]
   workflow_dispatch:
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 env:
   UV_VERSION: "0.8.3"
   PYTHON_VERSION: "3.12"
@@ -116,14 +122,16 @@ jobs:
       - name: DB ownership summary
         if: always() && steps.changed.outputs.run_full == 'true'
         run: |
-          echo "## DB Ownership CI Twin (OMN-2150)" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Mirrors runtime assertion B1:" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Provisions temp SQLite database" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Runs db_metadata migration" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Verifies owner_service matches expected value" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Validates Pydantic model roundtrip" >> "$GITHUB_STEP_SUMMARY"
-          echo "- Detects wrong ownership and missing table" >> "$GITHUB_STEP_SUMMARY"
+          {
+            echo "## DB Ownership CI Twin (OMN-2150)"
+            echo ""
+            echo "Mirrors runtime assertion B1:"
+            echo "- Provisions temp SQLite database"
+            echo "- Runs db_metadata migration"
+            echo "- Verifies owner_service matches expected value"
+            echo "- Validates Pydantic model roundtrip"
+            echo "- Detects wrong ownership and missing table"
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Short-circuit summary (no relevant changes)
         if: steps.changed.outputs.run_full != 'true'

.github/workflows/check-handshake.yml

@@ -10,6 +10,12 @@ on:
     branches: [main, develop, dev]
   workflow_dispatch:
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 jobs:
   occ-preflight:
     uses: ./.github/workflows/occ-preflight.yml

.github/workflows/cr-thread-gate-caller.yml

@@ -14,6 +14,12 @@ on:
     types: [checks_requested]
     branches: [main, dev]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 jobs:
   occ-preflight:
     uses: ./.github/workflows/occ-preflight.yml

.github/workflows/dep-provenance-gate.yml

@@ -36,6 +36,12 @@ on:
     branches: [main, dev]
   merge_group:
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 permissions:
   contents: read
 

.github/workflows/main-target-guard.yml

@@ -11,6 +11,12 @@ on:
   pull_request:
     types: [opened, edited, synchronize]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 jobs:
   occ-preflight:
     uses: ./.github/workflows/occ-preflight.yml

.github/workflows/no-faked-boundary.yml

@@ -33,6 +33,12 @@ on:
     branches: [main, dev]
   merge_group:
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 permissions:
   contents: read
 

.github/workflows/omni-standards-compliance.yml

@@ -22,6 +22,12 @@ on:
   pull_request:
     branches: [main, develop, dev]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 env:
   PYTHON_VERSION: "3.12"
   UV_VERSION: "0.8.3"

.github/workflows/pr-title-check.yml

@@ -8,6 +8,12 @@ on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 jobs:
   occ-preflight:
     uses: ./.github/workflows/occ-preflight.yml

.github/workflows/precommit-parity-gate.yml

@@ -48,6 +48,12 @@ on:
   merge_group:
   workflow_dispatch:
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 permissions:
   contents: read
 

.github/workflows/required-check-skip-guard-caller.yml

@@ -33,6 +33,12 @@ on:
   merge_group:
     types: [checks_requested]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 permissions:
   contents: read
 

.github/workflows/security-scan.yml

@@ -16,6 +16,12 @@ on:
     # Run weekly on Monday at 06:00 UTC
     - cron: "0 6 * * 1"
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 jobs:
   occ-preflight:
     uses: ./.github/workflows/occ-preflight.yml

.github/workflows/semantic-diff-labeler.yml

@@ -4,6 +4,12 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 jobs:
   occ-preflight:
     uses: ./.github/workflows/occ-preflight.yml

.github/workflows/stale-todo-gate.yml

@@ -22,6 +22,12 @@ on:
   pull_request:
     branches: [main, dev]
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 jobs:
   occ-preflight:
     uses: ./.github/workflows/occ-preflight.yml

.github/workflows/todo-audit-on-merge.yml

@@ -31,6 +31,12 @@ on:
       - main
       - dev
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 jobs:
   todo-audit:
     name: TODO Audit

.github/workflows/url-authority-gate.yml

@@ -32,6 +32,12 @@ on:
     branches: [main, dev]
   merge_group:
 
+# OMN-19639: cancel only superseded pull request runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+
 permissions:
   contents: read