ci: stop three main gates being starved to zero executions (#7205)

[proggeramlug]

Measured on main, last ~10 runs each:

workflow	cancelled	success
security-audit	9	0	required status check
eh-transport	8	0
llvm-inprocess	8	0	gate for the backend #7353 just defaulted
gc-moving-witnesses	0	2	already fixed by #7205

Two of the three had a comment claiming they were already safe:

"Cancel superseded PR runs, never main runs — a busy merge day would otherwise starve the gate to zero executions."

A busy merge day starved them anyway, by a mechanism that comment didn't anticipate. cancel-in-progress: false is not sufficient: GitHub allows at most one pending run per concurrency group and cancels the previously pending one when a new run enters, regardless of that setting. With the group keyed on github.ref, every main push shares one group, so a merge burst cancels the intermediates.

gc-moving-witnesses.yml already carries both the diagnosis and the fix (#7205) — keying push runs on github.sha so every merged commit gets its own group. This applies it to the three still on the old shape. security-audit additionally had cancel-in-progress: true, which cancels main runs outright.

How it was found, because the method matters

Not by reading the config — two of these looked correct, and I'd have skipped them. It came from watching what main runs actually concluded after the flip: a cancelled notification that looked benign turned out to be the eighth in a row.

That's CLAUDE.md's hazard 3 in a form the existing guard was written against and still didn't stop.

cache-warm is also 9/9 cancelled but deliberately left alone — it's an idempotent cache warmer, where cancelling a superseded run is the intended behaviour.

Config-only.

Summary by CodeRabbit

• Chores
  • Improved automated validation workflows so independent commits can complete without being cancelled by newer changes.
  • Pull-request checks remain cancellable when superseded, reducing unnecessary resource usage while preserving faster feedback.
  • Scheduled security audits now run to completion reliably, improving the consistency of ongoing project checks.

[coderabbitai]

📝 Walkthrough

Walkthrough

Three GitHub Actions workflows now group runs by event and commit or reference. Push runs are not cancelled by later runs. Pull-request runs remain cancellable.

Changes

CI concurrency behavior

Layer / File(s)	Summary
Event-aware workflow concurrency .github/workflows/eh-transport.yml, .github/workflows/llvm-inprocess.yml, .github/workflows/security-audit.yml	Push runs use commit-specific concurrency groups. Pull-request runs use reference-based groups and remain cancellable. Scheduled runs in security-audit.yml are no longer cancelled.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the CI change and the three affected main-branch gates.
Description check	✅ Passed	The description clearly explains the problem, affected workflows, root cause, and SHA-based fix.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/7205-concurrency-starves-main-gates

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}