From 9057d449d215b683c0eb914ddee657360761b99e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ralph=20K=C3=BCpper?= <ralph@skelpo.com>
Date: Tue, 4 Aug 2026 10:40:38 +0200
Subject: [PATCH] ci: stop three main gates being starved to zero executions
 (#7205)

Measured on main, last ~10 runs each:

    security-audit    9 cancelled, 0 success   <- REQUIRED context
    eh-transport      8 cancelled, 0 success
    llvm-inprocess    8 cancelled, 0 success
    gc-moving-witness 0 cancelled, 2 success   <- already fixed

Two of the three had a comment claiming they were already safe:
"cancel superseded PR runs, never main runs -- a busy merge day would
otherwise starve the gate to zero executions." A busy merge day starved
them anyway, by a mechanism the comment did not anticipate.

 is not sufficient. GitHub allows at most one
PENDING run per concurrency group and cancels the previously pending one
when a new run enters, regardless of that setting. With the group keyed
on , every main push shares one group, so a merge burst
cancels the intermediate runs. gc-moving-witnesses already carries both
the diagnosis and the fix (#7205); this applies it to the three that
still had the old shape. security-audit additionally had
, which cancels main runs outright.

Keying push runs on the SHA gives every merged commit its own group.

This is CLAUDE.md hazard 3, and it is worth noting how it was found: not
by reading the config -- two of these LOOKED correct -- but by asking
what each workflow's main runs actually concluded. llvm-inprocess is the
gate for the backend #7353 just made the default, and it had never
executed on main.
---
 .github/workflows/eh-transport.yml   | 10 +++++++---
 .github/workflows/llvm-inprocess.yml | 10 +++++++---
 .github/workflows/security-audit.yml | 13 +++++++++++--
 3 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/eh-transport.yml b/.github/workflows/eh-transport.yml
index 4a33949b48..ad8d9f0087 100644
--- a/.github/workflows/eh-transport.yml
+++ b/.github/workflows/eh-transport.yml
@@ -32,9 +32,13 @@ on:
     branches: [main]
 
 concurrency:
-  group: eh-transport-${{ github.ref }}
-  # Cancel superseded PR runs, never main runs — a busy merge day would
-  # otherwise starve the gate to zero executions.
+  group: eh-transport-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  # One group per main COMMIT, cancelling PR runs only. `cancel-in-progress:
+  # false` alone does not protect a `main` run: GitHub allows at most one
+  # PENDING run per group and cancels the previously pending one when a new run
+  # enters, regardless of that setting. That is #7205 — measured here as EIGHT
+  # consecutive `main` runs cancelled, zero executions. Keying push runs on the
+  # SHA gives every merged commit a group of its own.
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
diff --git a/.github/workflows/llvm-inprocess.yml b/.github/workflows/llvm-inprocess.yml
index 078d9736aa..2c572a7459 100644
--- a/.github/workflows/llvm-inprocess.yml
+++ b/.github/workflows/llvm-inprocess.yml
@@ -20,9 +20,13 @@ on:
     branches: [main]
 
 concurrency:
-  group: llvm-inprocess-${{ github.ref }}
-  # Gate-trap 3: cancel superseded PR runs, but NEVER cancel main runs — a
-  # busy merge day would otherwise starve the gate to zero executions.
+  group: llvm-inprocess-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  # One group per main COMMIT, cancelling PR runs only. `cancel-in-progress:
+  # false` alone does not protect a `main` run: GitHub allows at most one
+  # PENDING run per group and cancels the previously pending one when a new run
+  # enters, regardless of that setting. That is #7205 — measured here as EIGHT
+  # consecutive `main` runs cancelled, zero executions. Keying push runs on the
+  # SHA gives every merged commit a group of its own.
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index ee746829e6..6a0a72ed1b 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -12,8 +12,17 @@ permissions:
   contents: read
 
 concurrency:
-  group: security-audit-${{ github.ref }}
-  cancel-in-progress: true
+  # One group per main COMMIT, cancelling PR runs only. Two separate problems
+  # were live here, and this is a REQUIRED status check: it had NINE cancelled
+  # `main` runs and zero executions.
+  #
+  # `cancel-in-progress: true` cancels main runs outright, and even `false`
+  # would not have been enough — GitHub allows at most one PENDING run per
+  # group and cancels the previously pending one when a new run enters,
+  # regardless of that setting (#7205). Keying push runs on the SHA gives every
+  # merged commit a group of its own.
+  group: security-audit-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   security-audit: