From a9ab2a62ba16540e5ae7460f05640e892597635b Mon Sep 17 00:00:00 2001
From: Niels Lohmann <mail@nlohmann.me>
Date: Fri, 25 Sep 2026 20:40:28 +0200
Subject: [PATCH] Cancel superseded runs of the remaining workflows (#5579)

Ubuntu, Windows, macOS, and CodeQL already cancel an older run of the same
workflow on the same ref. Check amalgamation, CIFuzz, Dependency Review,
Flawfinder, Semgrep, Scorecard, and the labeler did not, so every push
to a pull request left their earlier runs going. Give them the same
concurrency group. The labeler runs on pull_request_target, where
github.ref is the base branch, so it groups by pull request number.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
---
 .github/workflows/check_amalgamation.yml | 4 ++++
 .github/workflows/cifuzz.yml             | 4 ++++
 .github/workflows/dependency-review.yml  | 4 ++++
 .github/workflows/flawfinder.yml         | 4 ++++
 .github/workflows/labeler.yml            | 6 ++++++
 .github/workflows/scorecards.yml         | 4 ++++
 .github/workflows/semgrep.yml            | 4 ++++
 7 files changed, 30 insertions(+)

diff --git a/.github/workflows/check_amalgamation.yml b/.github/workflows/check_amalgamation.yml
index f692e434a..670269cbb 100644
--- a/.github/workflows/check_amalgamation.yml
+++ b/.github/workflows/check_amalgamation.yml
@@ -3,6 +3,10 @@ name: "Check amalgamation"
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 2e50fee9c..9398fdbaf 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -1,6 +1,10 @@
 name: CIFuzz
 on: [pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index aa09008a3..2052c1d35 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -9,6 +9,10 @@
 name: 'Dependency Review'
 on: [pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/flawfinder.yml b/.github/workflows/flawfinder.yml
index 2c8befd40..753b81e0d 100644
--- a/.github/workflows/flawfinder.yml
+++ b/.github/workflows/flawfinder.yml
@@ -5,6 +5,10 @@
 
 name: flawfinder
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 3b4571b95..a93c86ae2 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -4,6 +4,12 @@ on:
   pull_request_target:
     types: [opened, synchronize]
 
+# pull_request_target runs on the base branch, so github.ref would put all pull
+# requests into one group; group by pull request number instead
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 113da079a..96f87526a 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -14,6 +14,10 @@ on:
   push:
     branches: ["develop"]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index dc326db55..922c9ca86 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -19,6 +19,10 @@ on:
   schedule:
     - cron: '23 2 * * 4'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read