From 4630af64373c7b8b25929c438ce8bc7d9706ea5c Mon Sep 17 00:00:00 2001
From: Martin Vogel <martin.vogel@datadice.io>
Date: Fri, 12 Jun 2026 16:59:56 +0200
Subject: [PATCH] Cancel superseded CI runs on new pushes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A new push to a PR (or ref) now cancels the in-progress validation for
the previous commit instead of letting obsolete pipelines run to
completion. Drafts deliberately keep the full gate set — multi-platform
feedback matters most during iteration.

Signed-off-by: Martin Vogel <martin.vogel@datadice.io>
---
 .github/workflows/codeql.yml | 4 ++++
 .github/workflows/dco.yml    | 4 ++++
 .github/workflows/pr.yml     | 7 +++++++
 3 files changed, 15 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c9df14593..4351c4cda 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -10,6 +10,10 @@ permissions:
   security-events: write
   contents: read
 
+concurrency:
+  group: codeql-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index 22e4cb5e3..c138b7054 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -10,6 +10,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: dco-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   dco:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 7e40c114c..dc28ac6ca 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -11,6 +11,13 @@ on:
 permissions:
   contents: read
 
+# A new push to the PR supersedes the running validation — cancel it
+# instead of stacking zombie pipelines.
+concurrency:
+  group: pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+
 jobs:
   security:
     uses: ./.github/workflows/_security.yml