Cancel superseded CI runs on new pushes

A new push to a PR (or ref) now cancels the in-progress validation for
the previous commit instead of letting obsolete pipelines run to
completion. Drafts deliberately keep the full gate set — multi-platform
feedback matters most during iteration.

Signed-off-by: Martin Vogel <martin.vogel@datadice.io>

.github/workflows/codeql.yml

@@ -10,6 +10,10 @@ permissions:
   security-events: write
   contents: read
 
+concurrency:
+  group: codeql-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     runs-on: ubuntu-latest

.github/workflows/dco.yml

@@ -10,6 +10,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: dco-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   dco:
     runs-on: ubuntu-latest

.github/workflows/pr.yml

@@ -11,6 +11,13 @@ on:
 permissions:
   contents: read
 
+# A new push to the PR supersedes the running validation — cancel it
+# instead of stacking zombie pipelines.
+concurrency:
+  group: pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+
 jobs:
   security:
     uses: ./.github/workflows/_security.yml