👷(ci) cancel the superseded runs of a pull request

adding a concurrency group will now stop running CI if a new push is
made on the same branch.

.github/workflows/crowdin_download.yml

@@ -9,6 +9,12 @@ on:
 permissions:
   contents: read
 
+# One run per branch: a new push cancels the run of the previous one, only the
+# latest commit needs to be synchronized with Crowdin.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   install-dependencies:
     uses: ./.github/workflows/dependencies.yml

.github/workflows/crowdin_upload.yml

@@ -9,6 +9,12 @@ on:
 permissions:
   contents: read
 
+# One run per branch: a new push cancels the run of the previous one, only the
+# latest commit needs to be synchronized with Crowdin.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   install-dependencies:
     uses: ./.github/workflows/dependencies.yml

.github/workflows/docker-hub.yml

@@ -19,6 +19,14 @@ env:
 permissions:
   contents: read
 
+# One run per pull request: a new push cancels the run of the previous one.
+# Branches and tags get a group of their own, queued instead of cancelled (only
+# the latest pending run is kept): an image push or the Argo CD notification is
+# never stopped halfway, and two runs never race to push the same tag.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-and-push-backend:
     uses: ./.github/workflows/docker-publish.yml

.github/workflows/ghcr.yml

@@ -16,6 +16,13 @@ env:
 permissions:
   contents: read
 
+# One run per branch or tag, queued instead of cancelled (only the latest
+# pending run is kept): an image push is never stopped halfway, and two runs
+# never race to push the same tag.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   build-and-push-backend:
     runs-on: ubuntu-latest

.github/workflows/helmfile-linter.yaml

@@ -7,6 +7,13 @@ on:
     branches:
       - 'main'
 
+# One run per pull request: a new push cancels the checks of the previous one.
+# Pushes get a group of their own (the commit), so every commit of main keeps
+# its full set of checks.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   helmfile-lint:
     runs-on: ubuntu-latest

.github/workflows/impress-frontend.yml

@@ -11,6 +11,13 @@ on:
 permissions:
   contents: read
 
+# One run per pull request: a new push cancels the checks of the previous one.
+# Pushes get a group of their own (the commit), so every commit of main keeps
+# its full set of checks.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
 
   install-dependencies:

.github/workflows/impress.yml

@@ -11,6 +11,13 @@ on:
 permissions:
   contents: read
 
+# One run per pull request: a new push cancels the checks of the previous one.
+# Pushes get a group of their own (the commit), so every commit of main keeps
+# its full set of checks.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   install-dependencies:
     uses: ./.github/workflows/dependencies.yml

.github/workflows/label_preview.yml

@@ -7,6 +7,12 @@ on:
 permissions: 
   pull-requests: write
 
+# One run per pull request: a new event (opened, labeled) cancels the run of
+# the previous one.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   comment:
     runs-on: ubuntu-latest

.github/workflows/loadtest.yml

@@ -11,6 +11,13 @@ on:
 permissions:
   contents: read
 
+# One run per pull request: a new push cancels the checks of the previous one.
+# Pushes get a group of their own (the commit), so every commit of main keeps
+# its full set of checks.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 # The load-test tooling of src/loadtest (see documentation/load-testing.md).
 # swarm and canary are standalone TypeScript packages, each with its own
 # package.json and yarn.lock, like src/yhub-server; k6 runs plain scripts and

.github/workflows/yhub.yml

@@ -18,6 +18,13 @@ defaults:
   run:
     working-directory: src/yhub-server
 
+# One run per pull request: a new push cancels the checks of the previous one.
+# Pushes get a group of their own (the commit), so every commit of main keeps
+# its full set of checks.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   lint-yhub:
     runs-on: ubuntu-latest