From aef708c96f938c77e10282a413a96176caa28206 Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Sat, 22 Aug 2026 15:31:14 +0200 Subject: [PATCH 1/2] fix(ci): stop comment runs from evicting the release push run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A merge to main fires two release runs at once: the push, and an issue_comment from whichever bot comments on the PR. Both resolve `github.ref_name` to the default branch, so the workflow-level concurrency group held both. `cancel-in-progress: false` only protects a run already in progress — a pending run is evicted when a newer one joins the group, so the comment run displaced the push run before it started a single job. Only the push run releases; every comment run has `check` gate both mutating jobs off. Merging #581 hit this: the push run was cancelled with zero jobs, CI stayed green, and the release branch silently kept the prior commit. The group moves to `pull-request` and `release`, which are what actually push the release branch. They share one group so they stay mutually exclusive, and a job gated off by `check` never joins it, so a no-op comment run has nothing to displace. Signed-off-by: Rhuan Barreto --- .github/workflows/release.yml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0f6eb9fa..c5eae917 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,9 +7,11 @@ on: branches: - main -concurrency: - group: release-${{ github.ref_name }} - cancel-in-progress: false +# Concurrency sits on the mutating jobs below, never here. An `issue_comment` +# run and the `push` run for the same merge both resolve `github.ref_name` to +# the default branch, so a workflow-level group lets the newer comment run +# evict the still-pending push run — the only run that releases. A job gated +# off by `check` never enters the group, so comment runs cannot displace a push. permissions: {} @@ -77,6 +79,10 @@ jobs: contents: read needs: check if: needs.check.outputs.workflow == 'pull-request' + # Shares one group with `release`: both push the release branch. + concurrency: + group: release-branch-${{ github.ref_name }} + cancel-in-progress: false steps: # Use a GitHub App installation token (not GITHUB_TOKEN) so the push to the # release branch triggers downstream `pull_request` events on the release PR. @@ -147,6 +153,10 @@ jobs: id-token: write needs: check if: needs.check.outputs.workflow == 'release' + # Shares one group with `pull-request`: both push the release branch. + concurrency: + group: release-branch-${{ github.ref_name }} + cancel-in-progress: false steps: - name: Generate token id: generate_token From 1a9331407a3734905bd14a585e9c0b850c5c9c02 Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Sat, 22 Aug 2026 15:37:37 +0200 Subject: [PATCH 2/2] docs(ci): drop the concurrency rationale block from release.yml GEN-004 keeps comments to current behaviour and leaves the why to commits and PRs, which already carry it. The per-job notes on the shared group stay: they describe what the group does, not how it got there. Signed-off-by: Rhuan Barreto --- .github/workflows/release.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c5eae917..a265d18c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,12 +7,6 @@ on: branches: - main -# Concurrency sits on the mutating jobs below, never here. An `issue_comment` -# run and the `push` run for the same merge both resolve `github.ref_name` to -# the default branch, so a workflow-level group lets the newer comment run -# evict the still-pending push run — the only run that releases. A job gated -# off by `check` never enters the group, so comment runs cannot displace a push. - permissions: {} env: